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Foreword 



This Technical Specification (TS) has been produced by the 3rd Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



The present document specifies the stage 2 of the LoCation Services (LCS) feature in UMTS, GSM and EPS (for E- 
UTRAN), which provides the mechanisms to support mobile location services for operators, subscribers and third party 
service providers. 

The present document replaces the specifications TS 23. 171 (Release 1999) and the system and core network parts of 
GSM 03.71 (Release 1999). TS 43.059 [16] replaces the radio access network parts of GSM 03.71 (Release 1999). 

Location Services may be considered as a network provided enabling technology consisting of standardised service 
capabilities, which enable the provision of location applications. The application(s) maybe service provider specific. 
The description of the numerous and varied possible location applications which are enabled by this technology are 
outside the scope of the present document. However, clarifying examples of how the functionality being described may 
be used to provide specific location services may be included. 

This stage 2 service description covers the LCS system functional model for the whole system, the LCS system 
architecture, state descriptions, message flows, etc. 
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3 Definitions, symbols and abbreviations 

3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply: 

CAMEL: CAMEL is a network functionality, which provides the mechanisms of Intelligent Network to a mobile user. 

Call Related: any LCS related operation which is associated with an established call in CS domain and a session via an 
active PDP context in PS domain. 

Codeword: access code, which is used by a Requestor or LCS Client in order to gain acceptance of a location request 
for a Target UE. The codeword is part of the privacy information that may be registered by a Target UE user. 

Current Location: after a location attempt has successfully delivered a location estimate and its associated time stamp, 
the location estimate and time stamp is referred to as the "current location" at that point in time. 

Deferred location request: location request where the location response (responses) is (are) required after a specific 
event has occurred. The event may or may not occur immediately. 

Global Navigation Satellite System: Global Navigation Satelhte System (GNSS) consists of three functional elements: 
Space Segment (satellites). User Segment (receivers), and Control Segment (maintenance etc.). The GNSS receiver 
calculates its own position based on the received time differences for several satellites. GNSS include Global 
Positioning System (GPS) and GALILEO. 

Immediate location request: location request where a single location response only is required immediately 

Initial Location: in the context of an originating emergency call the location estimate and the associated time stamp at 
the commencement of the call set-up is referred to as "initial location". 

Last Known Location: current location estimate and its associated time stamp for Target UE stored in the LCS Server 
is referred to as the "last known location" and until replaced by a later location estimate and a new time stamp is 
referred to as the "last known location". 

LCS (Location Services): LCS is a service concept in system (e.g. GSM or UMTS) standardization. LCS specifies all 
the necessary network elements and entities, their functionalities, interfaces, as well as communication messages, due to 
implement the positioning functionality in a cellular network. Note that LCS does not specify any location based (value 
added) services except locating of emergency calls. 

LCS Client: software and/or hardware entity that interacts with a LCS Server for the purpose of obtaining location 
information for one or more Mobile Stations. LCS Clients subscribe to LCS in order to obtain location information. 
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LCS Clients may or may not interact with human users. The LCS Client is responsible for formatting and presenting 
data and managing the user interface (dialogue). The LCS Client may reside in the Mobile Station (UE). 

LCS Client Access barring list: optional list of MSISDNs per LCS Client where the LCS Client is not allowed to 
locate any MSISDN therein. 

LCS Client Subscription Profile: collection of subscription attributes of LCS related parameters that have been agreed 
for a contractual period of time between the LCS client and the service provider. 

LCS Feature: capability of a PLMN to support LCS Client/server interactions for locating Target UEs. 

LCS QoS Class: The QoS class determines the degree of adherence to the quality of service information as required by 
the source of a location request. 

LCS Server: software and/or hardware entity offering LCS capabilities. The LCS Server accepts requests, services 
requests, and sends back responses to the received requests. The LCS server consists of LCS components, which are 
distributed to one or more PLMN and/or service provider. 

LDR reference number: the identity which is assigned and maintained by the H-GMLC and circulated between the 
LCS Client, R-GMLC, H-GMLC, V-GMLC, MSC/SGSN and UE. With the identity of the UE, the LDR reference 
number can unique identify a Location Deferred Request. Notes: UE is involved only when the event type of the 
deferred request is "change of area" or "periodic location". In addition, in a Periodical Immediate/deferred LCS Service 
Request, the LDR reference number is exclusive. 

Local Information: information related to a given location, or general information, which is made available in a given 
location. 

Local Service: service, which can be exclusively provided in the current serving network by a Value added Service 
Provider. 

Location (Based) Application: location application is an application software processing location information or 
utilizing it in some way. The location information can be input by a user or detected by network or UE. Navigation is 
one location application example. 

Location Based Service (LBS): service provided either by teleoperator or a 3rd party service provider that utilizes the 
available location information of the terminal. Location Application offers the User Interface for the service. LBS is 
either a pull or a push type of service (see Location Dependent Services and Location Independent Services). In 
ETSI/GSM documentation of SoLSA, LBS is called "Location Related Service". ETSI and/or 3GPP -wide terminology 
harmonization is expected here. 

Location Dependent Service: service provided either by teleoperator or a 3rd party service provider that is available 
(pull type) or is activated (push type) when the user arrives to a certain area. It doesn't require any subscription in 
advance, but the push type activation shall be confirmed by the user. The offered service itself can be any kind of 
service (e.g. a public Xerox machine or the discount list in a store). 

Location Estimate: geographic location of an UE and/or a valid Mobile Equipment (ME), expressed in latitude and 
longitude data. The Location Estimate shall be represented in a well-defined universal format. Translation from this 
universal format to another geographic location system may be supported, although the details are considered outside 
the scope of the primitive services. The location estimate may include the velocity of the UE. 

Location Identifier: information about the current location of the UE in the network. Location is indicated in network 
terms, for example using the global cell id in cellular networks, line-id in fixed broadband networks, the (MAC) address 
of the WLAN AP or Location Object as defined by IETF RFC 4119 [40], (OMA-Location also uses this term, but OMA 
so far defines the Location Identifier only for cellular access). 

Location Independent Service: service provided either by teleoperator or a 3rd party service provider that is available 
and therefore can be activated anywhere in the network coverage. It is activated by the user's request or by other user's 
activated service, and therefore it requires a subscription in advance (pull type). The offered service itself can be any 
kind of service (e.g. MMS, SWDL, or LBS!). 

Location Retrieval Function (LRF): this functional entity handles the retrieval of location information for the UE 
including, where required, interim location information, initial location information and updated location information. 
The LRF may interact with a separate RDF or contain an integrated RDF in order to obtain routing information. The 
LRF may interact with a separate GMLC or contain an integrated GMLC in order to obtain location information. The 
LRF may interact with or contain other types of location server functions in order to obtain location information. 
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Mobile Assisted positioning: any mobile centric positioning method (e.g. IPDL-OTDOA, E-OTD, GPS) in which the 
UE provides position measurements to the network for computation of a location estimate by the network. The network 
may provide assistance data to the UE to enable position measurements and/or improve measurement performance. 

Mobile Based positioning: any mobile centric positioning method (e.g. IPDL-OTDOA, E-OTD, GPS) in which the UE 
performs both position measurements and computation of a location estimate and where assistance data useful or 
essential to one or both of these functions is provided to the UE by the network. Position methods where an UE 
performs measurements and location computation without network assistance data are not considered within this 
category. 

Mobile Station: mobile station (MS) consists of Mobile or User Equipment (ME or UE) with a valid SIM or USIM 
attached. The abbreviation "UE" in this specification refers both to MS and User Equipment, see below. 

MO-LR Short Circuit: use of an MO-LR based procedure to provide a location estimate directly from the UE to the 
serving SGSN or MSC using a Mobile Based positioning method (e.g. GPS) according to the requested LCS QoS and 
that is not obtained or verified by the RAN. 

Network-based positioning: a positioning method (i.e. UTDOA) in which multiple network nodes (e.g. LMUs) 
perform position radio measurements based on UL transmissions from a mobile terminal to provide them to an 
E-SMLC for computation of a location estimate for the mobile terminal. 

Non-dialable call back number: In case of a SIM-less emergency call, or a non-registered (U)SIM emergency call, a 
non-dialable callback number shall be used to identify the target UE. The format and structure of the non-dialable 
callback number is according to national or regional regulations. 

Non-registered (U)SIM emergency call: The emergency call where the U(SIM) has not been authenticated and have 
not been registered in the VLR. Examples of such cases could be emergency call from a blocked (U)SIM due to 
mistyped PIN, or when the UE is in "enter PIN" mode, or the emergency call is performed in another network with no 
roaming agreement with the home PLMN. Any IMSI retrieved from such a (U)SIM cannot be trusted and so cannot be 
used to identify the calling party. 

PLMN Access barring list: optional list of MSISDN per PLMN where any LCS Client is not allowed to locate any 
MSISDN therein except for certain exceptional cases. 

Positioning (/location detecting): positioning is a functionality, which detects a geographical location and optionally, 
velocity (of e.g. a mobile terminal). 

Positioning method (/locating method): method or technical solution, which is used to get an estimate of the target 
mobile's geographical location. For example positioning methods based on radio cell coverage, GPS or Assisted GPS 
methods, which are based on the Time-Of- Arrival (TO A) algorithm, and UTDOA, OTDOA or E-OTD methods, which 
are based on the Time-Difference-Of- Arrival (TDOA) algorithm. The positioning methods are further described in E- 
UTRAN Stage 2, TS 36.305 [42], UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

Predefined area: geographical area, which is not related to cell or radio coverage. The mobile may take special action 
when it recognises it has entered or left a predefined area. 

Privacy Class: list of LCS Clients defined within a privacy exception class to which permission may be granted to 
locate the target UE. The permission shall be granted either on activation by the target UE or permanently for a 
contractual period of time agreed between the target UE and the service provider. 

Privacy Exception List: list consisting of various types of privacy classes (i.e. operator related, personal etc.). Certain 
types of classes may require agreement between the service provider and the target UE. 

Privacy Profile Register, PPR: The PPR stores privacy information of the target mobile. The PPR also executes 
privacy checks and sends the privacy check results to other network elements using the Lpp interface. PPR may be a 
standalone network entity or the PPR functionality may be integrated in H-GMLC. 

Prohibited area: area where the mobile must not activate its transmitter. The Prohibited area may be a Predefined area 
described above or related to radio cell(s). 

Pseudo-external identity: The pseudo-external identity is not the identity of real external LCS client but the identity, 
which is used for notifying the result of the enhanced privacy check. The pseudo-external identity shall keep the 
compatibility with pre Rel-6 privacy mechanisms, which does not understand privacy check result made by H- 
GMLC/PPR. Each operator defines its own the pseudo-external identities. 
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Pseudonym: A fictitious identity, which may be used to conceal the true identity (i.e. MSISDN and IMSI) of a target 
UE from the requestor and the LCS client. 

Pseudonym mediation device: Functionality that verifies pseudonyms to verinyms. 

Request id: identity which is used to identify the correspondence of a location request to multiple responses when the 
Response method is ASYNC. Each receiving GMLC (R-GMLC or V-GMLC or H-GMLC) allocates and maintains the 
Request id to identify each ASYNC location request, and includes it in the responses to the source entity of the location 
request (i.e. LCS client or GMLC). 

Requestor: the originating entity which has requested the location of the target UE from the LCS client. 

Requestor Identity: This identifier is identifying the Requestor and can be e.g. MSISDN or logical name. 

Response method: method how a GMLC, which receives a location request message from another entity (i.e. LCS 
client or GMLC), responds to the location request. There are two methods, synchronous (SYNC) and asynchronous 
(ASYNC). When the requesting entity wishes multiple responses (either about one or several target UE's location) to a 
single location request the procedure is ASYNC and when the requesting entity wishes a single response the procedure 
is SYNC. The source entity of the location request (i.e. LCS client or GMLC) can choose a preferred method and 
informs the method to the receiving GMLC. However, the selection of the method used is made by the receiving GMLC 
and when the ASYNC method is selected the Request id is notified to the source entity. The receiving GMLC can turn a 
SYNC request into an ASYNC procedure, e.g. in an overload situation, and the source entity (i.e. LCS client or GMLC) 
should be able to receive multiple responses even though the request was SYNC. 

Routing Determination Function (RDF): The functional entity, which may be integrated in a Location Server (e.g. 
GMLC) or in an LRF, provides the proper PSAP destination address to the E-CSCF for routing the emergency request. 
It can interact with a location functional entity (e.g. GMLC) to manage ESQK allocation and management, and deliver 
location information to the PSAP. 

Service Area Identifier (SAI): information, which is used to identify an area consisting of one or more cells belonging 
to the same Location Area, see TS 25.413 [14]. Such an area is called a Service Area and can be used for indicating the 
location of a UE to the CN. For this specification, only a Service Area that is defined to be applicable to the PS and CS 
domains shall be used. 

Service coverage: a list of country codes where an LCS client offers its location services. Country code in this context 
means E.164 country code for a geographic area [35a]. 

Service Type: attribute of specific location based service provided by the LCS client, as defined in TS 22.071 [4]. 

Serving cell identity: the Cell Global Identification (CGI), see TS 23.003 [17], of the cell currently used by the target 
UE, e.g. for an emergency call in A-mode. 

SIM-less emergency call: The emergency call that is originated from a UE, which does not have a SIM or USIM. 

Subscription Profile: profile detailing the subscription to various types of privacy classes. 

Target area: geographical area which is used for change of area type deferred location request. The target area is 
defined by the LCS client and is expressed as geographical area using a shape defined in TS 23.032 [11], as a 
geographical area using local coordinate system, as an E.164 country code for a geographic area [35a], as a PLMN 
identity or as a geopolitical name of the area (e.g. London). 

Target UE: UE being positioned. 

User Equipment: term 'User Equipment', or 'UE', as defined in TR 21.905 [3]. UE in this specification may also refer 
to a Mobile Equipment or User Equipment used for emergency calls, that do not have valid SIM or USIM. 

Velocity: The speed of a UE and the direction in which it is travelling, encoded as defined in TS 23.032 [11]. Velocity 
may be defined as either 2-D (horizontal) velocity or 3-D (horizontal and vertical) velocity. Both 2-D and 3-D velocity 
may be reported either with or without uncertainty. 

Verinym: True identity, i.e. MSISDN or IMSI, of the target UE. 

Further UMTS related definitions are given in TS 22.101 [8]. 
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3.2 Symbols 



For the purposes of the present document, the following symbols apply: 



Dh 
Gb 
Gs 

La 
Lc 
Le 
Lg 

Lh 

Lid 

Lpp 

Lr 

Ml 

Sh 

SLg 

SLh 

SLs 

Um 

Uu 



Interface between LIMS-IWF and SLF 

Interface between 2G-SGSN and BSS 

Interface between MSC and SGSN 

Interface between GMLC and AAA 

Interface between gateway MLC and gsmSCF (CAMEL interface) 

Interface between External User and MLC (external interface) 

Interface between Gateway MLC - VMSC, GMLC - MSC Server, GMLC - SGSN (gateway MLC 

interface) 

Interface between Gateway MLC and HLR (MAP based) 

Interface between GMLC and PMD. 

Interface between GMLC(H-GMLC) and PPR entity. 

Interface between Gateway MLCs 

Interface between the E-CSCF and LRF 

Interface between LIMS-IWF and HSS 

Interface between GMLC and MME 

Interface between GMLC and HSS (Diameter based) 

Interface between MME and E-SMLC 

GERAN Air Interface 

UTRAN Air Interface 



3.3 



Abbreviations 



For the purposes of the present document, the following abbreviations apply: 

2G- Second Generation 

3G- Third Generation 

A-GNSS Assisted Global Navigation SatelHte System 

AAA Authentication, Authorization, Accounting 

AC Admission Control 

AI Application Interface (prefix to interface class method) 

ANM Answer Message (ISUP) 

APN Access Point Name 

APN-NI APN Network Identifier 

ARIB Association of Radio Industries and Business 

ATD Absolute Time Difference 

BCCH Broadcast Control Channel 

BER Bit Error Rate 

BSS Base Station Subsystem 

BTS Base Transceiver Station 

CAMEL Customised Application For Mobile Network Enhanced Logic 

CAP CAMEL Application Part 

CM Connection Management 

CN Core Network 

CSCF Call Service Control Function 

CSE Camel Service Environment 

DL Downlink 

DNS Domain Name System 

DRNC Drift RNC 

E-CSCF Emergency CSCF 

E-OTD Enhanced Observed Time Difference 

E-SLP Emergency SUPL Location Platform 

E-SMLC Evolved Serving Mobile Location Centre 

FER Frame Error Rate 

GERAN GSM EDGE Radio Access Network 

GGSN Gateway GPRS Support Node 

GMLC Gateway MLC 

GNSS Global Navigation Satellite System 
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GPRS General Packet Radio Service 

GPS Global Positioning System 

HE Home Environment 

H-GMLC Home-GMLC 

H-LIMS-IWF Home-LIMS-IWF 

HSS Home Subscriber Server 

HLR Home Location Register 

HPLMN Home Public Land Mobile Network 

IMEI International Mobile Equipment Identity 

IMS IP Multimedia Subsystem 

IMSI International Mobile Subscriber Identity 

IP Internet Protocol 

IPDL Idle Period Downlink 

IW-MT-LR Mobile Terminated Location Request for an I-WLAN 

I-WLAN Interworking WLAN 

LA Location Application 

LAP Location Application Function 

LBS Location Based Services 

LCAF Location Client Authorization Function 

LCCF Location Client Control Function 

LCCTF Location Client Co-ordinate Transformation Function 

LCF Location Client Function 

LCZTF Location Client Zone Transformation Function 

LCS Location Services 

LDR Location Deferred Request 

LIMS-IWF Location IMS - Interworking Function 

LIR Location Immediate Request 

LMU Location Measurement Unit 

LRF Location Retrieval Function 

LSAF Location Subscriber Authorization Function 

LSBcF Location System Broadcast Function 

LSBF Location System Billing Function 

LSCF Location System Control Function 

LSCTF Location System Co-ordinate Transformation Function 

LSOF Location System Operation Function 

LSPF Location Subscriber Privacy Function 

LSTF Location Subscriber Translation Function 

MAP Mobile Application Part 

ME Mobile Equipment 

MExE Mobile Execution Environment 

MGCF Media Gateway Control Function 

MLC Mobile Location Centre 

MLP Mobile Location Protocol 

MM Mobility Management 

MO-LR Mobile Originated Location Request 

MS Mobile Station 

MSC Mobile services Switching Centre 

MSISDN Mobile Station Integrated Services Data Network 

MT-LR Mobile Terminated Location Request 

NA-ESRD North American Emergency Service Routing Digits 

NA-ESRK North American Emergency Service Routing Key 

NI-LR Network Induced Location Request 

OMA Open Mobile Alliance 

OSA Open Service Architecture 

OTDOA Observed Time Difference Of Arrival 

PC Power Control 

PCF Power Calculation Function 

PLMN Public Land Mobile Network 

PMD Pseudonym mediation device functionality 

POI Privacy Override Indicator 

PPR Privacy Profile Register 

PRCF Positioning Radio Co-ordination Function 
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PRRM Positioning Radio Resource Management 

PSAP Public Safety Answering Point 

PSE Personal Service Environment 

PSMF Positioning Signal Measurement Function 

PSTN Public Switched Telephone Network 

QoS Quality of Service 

RA Routing Area 

RACH Random Access Channel 

RAN Radio Access Network 

RANAP Radio Access Network Application Part 

R-GMLC Requesting-GMLC 

RDF Routing Determination Function 

RIS Radio Interface Synchronization 

R-LIMS-IWF Requesting-LIMS-IWF 

RLP Roaming Location Protocol 

RNC Radio Network Controller 

RRM Radio Resource Management 

RTD Real Time Difference 

RTT Round Trip Time 

SAI Service Area Identifier 

SAT SIM Application Tool-Kit 

SCCP Signalling Connection Control Part 

SCS Service Capability Server 

SGSN Serving GPRS Support Node 

SI Service Interface (prefix to interface class method) 

SIM Subscriber Identity Module 

SIP Session Initiation Protocol 

SIP-URI SIP Uniform Resource Identifier 

SIR Signal Interference Ratio 

SLF Subscription Locator Function 

SEP SURE Location Platform 

SEPP Subscriber ECS Privacy Profile 

SMEC Serving Mobile Location Centre 

SMS Short Message Service 

SP Service Point 

SRNC Serving RNC 

SS7 SignalHng System No 7 

SUPE Secure User Plane Location 

TA Timing Advance 

TEL-URL Telephone Uniform Resource Locator 

TMSI Temporary Mobile Subscriber Identity 

TOA Time Of Arrival 

TTTP Transfer To Third Party 

UDT SCCP Unitdata message 

UE User Equipment 

UE Uphnk 

UMTS Universal Mobile Telecommunication System 

USIM Universal Subscriber Identity Module 

UTDOA Uplink Time Difference of Arrival 

UTRAN Universal Terrestrial Radio Access Network 

VASP Value Added Service Provider 

V-GMEC Visited -GMEC 

VHE Virtual Home Environment 

WCDMA Wideband Code Division Multiple Access 

Further related abbreviations are given in TR 2L905 [3]. 
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Main concepts 



A general description of location services and service requirements are given in the specification TS 22.071 [4]. The 
positioning of the UE is a service provided by the Access Network. In particular, all Access Networks (e.g. UTRAN, 
GERAN, E-UTRAN), that facilitate determination of the locations of User Equipments, shall be able to exchange 
location information with the core network as defined in the present document (when connected to a Core Network). 
Optionally, location information may also be communicated between GMLCs, located in the same or a different PLMN, 
via the specified GMLC to GMLC interface. 

By making use of the radio signals the capability to determine the (geographic) location of the user equipment (UE) or 
mobile station (UE) shall be provided. The location information may be requested by and reported to a client 
(application) associated with the UE, or by a client within or attached to the Core Network. The location information 
may also be utilised internally in the system; for example, for location assisted handover or to support other features 
such as home location billing. The location information request may ask for the velocity of the UE as part of the 
positioning information. The position information shall be reported in standard, i.e. geographical co-ordinates, together 
with the time-of-day and the estimated errors (uncertainty) of the location of the UE according to specification 
TS 23.032 [11]. The velocity of the UE may be optionally returned in a format specified in TS 23.032 [11]. 

It shall be possible for the majority of the UE (active or idle) within a network to use the feature without compromising 
the radio transmission or signalling capabilities of the GSM/UMTS/EPS networks. 

The UE and the network may support a number of different positioning methods and the UE may support or not support 
privacy invocation request and response. The UE informs the core network and radio access network about its LCS 
capabilities in this respect as defined in TS 24.008 [24] and TS 25.331 [25]. 

The uncertainty of the location measurement shall be network design (implementation) dependent at the choice of the 
network operator, this is further described in TS 25.305 [1], TS 36.305 [42], and TS 43.059 [16]. 

There are many different possible uses for the location information. The positioning feature may be used internally by 
the GSM/UMTS/EPS network (or attached networks), by value-added network services, by the UE itself or through the 
network, and by "third party" services. The positioning feature may also be used by an emergency service (which may 
be mandated or "value-added"), but the position service is not exclusively for emergencies. 

There are regulatory requirements to support anonymity in location services in some countries. 

4.1 Assumptions 

As a basis for the further development work on LCS in GSM, UMTS and EPS the following assumptions apply: 

positioning methods are Access Network specific, although commonalties should be encouraged between Access 
Networks; 

commercial location services are only applicable for an UE with a valid SIM or USIM; 

the provision of the location services in the Access Network is optional through support of the specified 
method(s); 

the provision of location services is optional in MSC, SGSN and MME; 

LCS is applicable to any target UE whether or not the UE supports LCS, but with restrictions on choice of 
positioning method or notification of a location request to the UE user when LCS or individual positioning 
methods, respectively, are not supported by the UE; 

LCS shall be applicable for both circuit switched and packet switched services; 

the location information may be used for internal system operations to improve system performance; 

it shall be possible to accommodate future techniques of measurement and processing to take advantage of 
advancing technology so as to meet new service requirements; 

it may be necessary to support LCS signalling between separate access networks via the core network. For 
UMTS, the lur interface should be used if available; 
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Provide positioning procedures through the circuit-switched domain are also applicable to GPRS UEs which are 
GPRS and IMSI attached; 

it shall be possible for more than one LCS Client to request and obtain the location of the same target UE at the 
same time. 



4.2 Location Services Categories 



Generally there are four categories of usage of the location service. These are the Commercial LCS, the Internal LCS, 
the Emergency LCS and the Lawful Intercept LCS. The definition of these services and their categories is outside the 
scope of the present document. 

The Commercial LCS (or Value Added Services) will typically be associated with an application that provides a 
value-added service to the subscriber of the service, through knowledge of the UE location (and optionally, 
velocity) and if available, and at the operator's discretion, the positioning method used to obtain the location 
estimate. This may be, for example, a directory of restaurants in the local area of the UE, together with directions 
for reaching them from the current UE location. 

The Internal LCS will typically be developed to make use of the location information of the UE for Access 
Network internal operations. This may include; for example, location assisted handover and traffic and coverage 
measurement. This may also include support certain O&M related tasks, supplementary services, IN related 
services and GSM bearer services and teleservices. 

The Emergency LCS will typically be part of a service provided to assist subscribers who place emergency calls. 
In this service, the location of the UE caller and, if available, the positioning method used to obtain the location 
estimate is provided to the emergency service provider to assist them in their response. This service may be 
mandatory in some jurisdictions. In the United States, for example, this service is mandated for all mobile voice 
subscribers. 

The Lawful Intercept LCS will use the location information to support various legally required or sanctioned 

services. 



4.3 Positioning methods 



The LCS feature utilises one or more positioning methods in order to determine the location of user equipment (UE). 
Determining the position of a UE involves two main steps: 

Radio signal measurements; and 

Position estimate computation based on the measurements. 

The positioning methods for UTRAN are further described in TS 25.305 [1]. 

4.3.1 Standard LCS IVIethods in UTRAN 

The specification TS 25.305 [1] UTRAN Stage 2 specifies the locating methods to be supported: 

cell coverage based positioning method; 

OTDOA positioning method; 

A-GNSS based positioning methods; 

UTDOA positioning method. 
For more details on these positioning methods, refer to TS 25.305 [1]. 

4.3.2 Standard LCS IVIethods in GERAN 

The specification TS 43.059 [16] GERAN LCS Stage 2 specifies the locating methods to be supported in GERAN: 
cell coverage based positioning method; 
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Enhanced Observed Time Difference (E-OTD) positioning method; 

A-GNSS based positioning methods; 

UpUnk Time Difference of Arrival (UTDOA) positioning method. 

4.3.3 Standard LCS Methods in E-UTRAN 

Locating methods specified in TS 36.305 [42] applicable to E-UTRAN comprise: 

uplink and downlink cell coverage based positioning methods; 

OTDOA positioning method; 

A-GNSS based positioning methods; 

UTDOA positioning method. 

Hybrid positioning using multiple methods from the list of positioning methods above is also supported.. 

In case of the Home eNodeB, applicable locating methods may be restricted, e.g. when a Home eNodeB is connected 
via Home eNodeB GW. 

4.4 Types of Location Request 

4.4.1 Immediate Location Request 

Request for location where the LCS Server replies immediately to the LCS Client with the current location estimate if 
this could be obtained. 

4.4.2 Deferred Location Request 

Request for location contingent on some current or future events where the response from the LCS Server to the LCS 
Client may occur some time after the request was sent. 

NOTE: Deferred Location Request is not supported for E-UTRAN Access in this version of the TS. 

4.4.2.1 Types of event 

a) UE available: Any event in which the MSC/SGSN has established a contact with the UE. Note, this event is 
considered to be applicable when the UE is temporarily unavailable due to inaction by the user, temporarily loss 
of radio connectivity or IMSI detach and so on. Note that IMSI detach is only applicable in the case the UE has 
previously been registered and information is still kept in the node. The UE Available event only requires one 
response and after this response, the UE Available event is concluded. 

b) Change of Area: An event where the UE enters or leaves a pre-defined geographical area or if the UE is 
currently within the pre-defined geographical area. The LCS client defines the target area as a geographical area, 
as an E.164 country code for a geographic area [35a], as a PLMN identity or as a geopolitical name of the area. 
The LCS server may translate and define the target area as the identities of one or more radio cells, location 
areas, routing areas, country code or PLMN identity. The target UE must not give the target UE user access to 
the area definitions and network identities. The change of area event may be reported one time only, or several 
times. The area event report must not be repeated more often than allowed by the LCS client. The change of area 
event report shall contain an indication of the event occurrence. The location estimate may be included in the 
report. 

c) Periodic Location: An event where a defined periodic timer expires in the UE and activates a location report or a 
location request. 

d) Other events are FFS. 
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4.5 Concurrent Location Requests 



The LCS Server is enabled to support concurrent location requests for the same target UE. The following principles 
apply. 

1 . Under certain conditions, an entity may combine concurrent location requests by fully executing one request and 
using the ensuing location estimate result(s) to satisfy the other request(s) without fully executing the latter and 
as allowed by QoS requirements. The allowed conditions for each type of entity are defined below: 

a) An R-GMLC may combine concurrent MT-LR requests for the same target UE-LCS Client pair. 

b) An H-GMLC may combine concurrent MT-LR requests for the same target UE if privacy requirements can 
be fully resolved by the H-GMLC (e.g. no notification or verification needed for the UE for any MT-LR that 
will not be fully executed). 

c) A V-GMLC may combine concurrent MT-LR and NI-LR related location requests for the same target UE 
provided it is clear and unambiguous for any MT-LR that will not be fully executed (e.g. from the contents of 
any MAP Provide Subscriber Location request received from the H-GMLC) that no outstanding privacy 
related actions are required for the UE (e.g. no privacy notification and/or privacy verification interaction 
with the UE and no privacy subscription verification in the VLR, SGSN or MME). 

d) An MSC, MSC server, SGSN or MME may combine concurrent MT-LR, MO-LR and NI-LR location 
requests once any needed privacy related actions (e.g. UE notification and verification) have been performed 
for each MT-LR. 

e) A UE may combine concurrent MO-LR requests for LCS Clients internal to or associated with the UE. 

2. Except under the conditions permitted in (1), different concurrent location requests shall be treated separately 
and shall not be visibly combined or made dependent on one another by any entity within the LCS Server. This 
means that the procedures defined here in clause 9 continue to apply to each separate location request and do not 
visibly impact one another. 

3. Implementation limitations are allowed whereby an entity that, either itself or in association with another entity, 
cannot support concurrent location requests or more than a certain number of concurrent location requests is 
allowed to reject or defer a new concurrent request or cancel one or more existing requests. When concurrent 
location requests are supported, each entity needs to ensure it correlates each location/position response with the 
associated request. 

4. In support of principles 1, 2 and 3, an entity (e.g. GMLC, MSC, MSC server, SGSN, MME, UE) that receives a 
new location request (e.g. MT-LR, MO-LR, NI-LR) while already supporting previous location requests for the 
same target UE may reject the new location request, defer (i.e. queue) the new request, cancel one or more 
previous requests (where a procedure for cancellation has been defined), allow the new location request to 
proceed concurrently with and separately from the previous requests if allowed on applicable interfaces or, for 
the specific cases defined in principle 1, combine the new request with one or more previous requests if this will 
not impair or affect service support for the new request (e.g. privacy and QoS). 

5. In support of principle 4, LCS Client priority and any other relevant priority information (e.g. UE subscription 
preferences) should be considered. In particular, location requests associated with emergency services or lawful 
interception clients should be given priority over other location requests. 



5 General LCS architecture 

5.1 LCS access interfaces 

One or more LCS Clients may access a Location Server via its Le interface. Location Servers, resident in the same or 
different PLMNs, may communicate with each other, indirectly, via the Lg interface to their associated MSC/SGSNs. 
Optionally, the Lr interface, as specified for direct GMLC to GMLC messaging, may be used for this purpose. For EPS, 
Location Servers, resident in the same PLMN, may communicate via the SLg interface to their associated MME. A 
fuller description of the LCS architecture, together with a diagram showing other LCS related interfaces, can be found 
in clause 6. 
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Figure 5.1 : LCS Access Interfaces and Reference Points 



5.2 LCS Functional diagram, high level functions 

TS 22.071 [4] describes LCS services from the LCS client point of view. In the present document, a more detailed 
description of LCS is given. The LCS functional diagram shown in figure 5.2 depicts the interaction of the LCS client 
and the LCS server within the PLMN. The PLMN uses the various LCS components within the LCS server to provide 
the target UE Location Information to the LCS client. 
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Figure 5.2: LCS capability server Functional Diagram 
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The following list gives the logical functional entities for the LCS. Two main functional groupings are defined which 
encompass a number of smaller functions. 

The LCS Functional entities are grouped as follows: 

the LCS Client functional group; 

- the LCS Server functional group consists of functions in the GSM, UMTS or EPS PLMN supporting LCS: 

client handling component; 

system handling component; 

subscriber handling component; 

positioning component. 

The functions of the LCS Client and the LCS Server in the PLMN are described in more detail in this clause. 

The allocation of LCS functions to network elements is specified in clause 6. 



5.3 LCS Client functional group 



An LCS client contains an LCS component with one or more client(s), which by using location information can provide 
location, based services. 

An LCS client is a logical functional entity that requests from the LCS server in the PLMN location information for one 
or more than one target UE within a specified set of parameters such as Quality of Service (QoS). The LCS Client may 
reside in an entity (including the UE) within the PLMN or in an entity external to the PLMN. 

The specification of the LCS Client's internal logic and its relation to the external use is outside the scope of the present 
document. 

5.3.1 External Location Client Function (LCF) 

The Location Client Function (LCF) provides a logical interface between the LCS client and the LCS server. 

This function is responsible for requesting location information for one or more UEs, with a specified "QoS" and 
receiving a response, which contains either location information or a failure indicator. 



5.4 LCS Server functional group 



The LCS server functional group consists of the functions that are needed for GSM, UMTS and EPS to support 
Location Services. 

5.4.1 Client handling component 

5.4.1 .1 Location Client Control Function (LCCF) 

The Location Client Control Function (LCCF) manages the external interface towards LCF. The LCCF identifies the 
LCS client by requesting client verification and authorization (i.e. verifies that the LCS client is allowed to position the 
subscriber) through interaction with the Location Client Authorization Function (LCAF). The LCCF handles mobility 
management for location services (LCS) e.g., forwarding of positioning requests to VMSC, SGSN or MME. The LCCF 
determines if the final positioning estimate satisfies the QoS for the purpose of retry/reject. The LCCF provides flow 
control of positioning requests between simultaneous positioning requests. It may order the Location Client Co-ordinate 
Transformation Function (LCCTF) to perform a transformation to local co-ordinates. It may also order a transformation 
of local co-ordinates to network identities via the Location System Co-ordinate Transformation Function (LSCTF). It 
also generates charging and billing related data for LCS via the Location System Billing Function (LSBF). 
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5.4.1 .2 Location Client Authorization Function (LCAF) 

The Location Client Authorization Function (LCAF) is responsible for providing access and subscription authorization 
to a client. Specifically, it provides authorization to a LCS client requesting access to the network and authorizes the 
subscription of a client. LCAF provides authorization to a LCS client requesting Location Information of a specific UE. 

5.4.1.2.1 Access Subfunctlon 

An Access Subfunction enables LCS clients to access LCS services. This subfunction provides verification and 
authorization of the requesting client. 

When a LCS is requested, the Access Subfunction uses the information stored in the LCS client subscription profile to 
verify that: 

the LCS client is registered; and 

the LCS client is authorized to use the specified LCS request type; 

the LCS client is allowed to request location information for the subscriber(s) specified in the LCS request. 

5.4.1.2.2 Subscription Subfunction 

The LCS client Subscription profile shall contain a minimum set of parameters assigned on per LCS client basis for an 
agreed contractual period. The LCS client profile shall contain the following set of access parameters: 

LCS client identity; 

allowed LCS request types (i.e. LIR, LDR or both) (see note); 

maximum number of subscribers allowed in a single LCS request; 

priority; 

position override indicator; 

state(s); 

event(s) (applicable to LDR requests only); 

local coordinate system; 

LCS client access barring list (optional); 

PLMN access barring list applicability. 

NOTE: LIR = Location Immediate Request; and 
LDR = Location Deferred Request. 

For certain authorized LCS client internal to the PLMN, a subscription profile is unnecessary. These clients are 
empowered to access any defined service that is not barred for an UE subscriber. This permits positioning of emergency 
calls without the need for pre-subscription. 

5.4.1 .3 Location Client Co-ordinate Transformation Function (LCCTF) 

The Location Client Co-ordinate Transformation Function (LCCTF) provides conversion of a location estimate 
expressed according to a universal latitude and longitude system into an estimate expressed according to a local 
geographic system understood by the LCF and known as location information. The local system required for a 
particular LCF will be either known from subscription information or explicitly indicated by the LCF. The LCCTF also 
provides the conversion of a target area to either a shape as defined in TS 23.032 [11], a PLMN, or country code. This is 
performed only if target area information is received from the LCS Client. 
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5.4.1 .4 Location Client Zone Transformation Function (LCZTF) 

The Location Client Zone Transformation Function (LCZTF) performs transformations of a location (latitude and 
longitude) into a zone identity, which in North America identifies a particular emergency services zone. 

5.4.2 System handling component 

5.4.2.1 Location System Control Function(LSCF) 

The Location System Control Function (LSCF) is responsible for co-ordinating location requests. This function 
manages call-related and non-call-related positioning requests of LCS and allocates network resources for handling 
them. The LSCF retrieves UE classmark information for the purpose of determining the LCS capabilities of UE. 

The LSCF performs call setup if required as part of a LCS e.g., putting the UE on dedicated radio resources. It also 
caters for co-ordinating resources and activities with regard to requests related to providing assistance data needed for 
positioning. This function interfaces with the LCCF, LSPF, LSBF and PRCF. Using these interfaces, it conveys 
positioning requests to the PRCF, relays positioning data to the LCCF and passes charging related data to the LSBF. 

The U-LSCF for UTRAN is further described in TS 25.305 [1], LSCF for GERAN is described in TS 43.059 [16]. 

5.4.2.2 Location System Billing Function (LSBF) 

The Location System Billing Function (LSBF) is responsible for charging and billing activity within the network related 
to location services (LCS). This includes charging and billing of both clients and subscribers. Specifically, it collects 
charging related data and data for accounting between PLMNs. 

5.4.2.3 Location System Operations Function (LSOF) 

The Location System Operations Function (LSOF) is responsible for provisioning of data, positioning capabilities, data 
related to clients and subscription (LCS client data and UE data), validation, fault management and performance 
management of LCS. 

An LSOF may be associated with each entity. 

5.4.2.4 Location System Broadcast Function (LSBcF) 

The Location System Broadcast Function (LSBcF) provides broadcast capability. The LSBcF capability is only used 
when broadcast data is required for E-OTD, OTDOA or A-GNSS positioning methods. 

5.4.2.5 Location System Co-ordinate Transformation Function (LSCTF) 

The Location System Co-ordinate Transformation Function (LSCTF) provides the conversion of an area definition, 
expressed in a geographic shape as defined in TS 23.032 [11], to network identities recognised only within a PLMN 
(such as Cell Identity, Location Area Identity). The area definition may convert to more than one network identity such 
as a collection of Cell Global Identities. 

5.4.2.6 Location IMS - Interworking Function (LIMS-IWF) 

The Location IMS - Interworking Function (LIMS-IWF) in the requesting network provides the capability to route LCS 
service requests based on an IMS Public User Identity (SIP-URI) to the home network of the target user. The LIMS- 
IWF in the home network of the target user is responsible to determine the appropriate HSS and to obtain the MSISDN 
associated with a IMS Public User Identity from the HSS. 

5.4.3 Subscriber handling Component 

5.4.3.1 Location Subscriber Authorization Function (LSAF) 

The Location Subscriber Authorization Function (LSAF) is responsible for authorizing the provision of a location 
service (LCS) for a particular mobile station (UE with SIM/USIM). Specifically, this function validates that a LCS can 
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be applied to a given subscriber. In case LCF is in the UE then LSAF verifies that the UE subscriber has subscribed to 
the requested LCS service. LSAF also detects if the identity used to address the target UE is a pseudonym. If the 
identity used is detected as a pseudonym, the LSAF can then call the Location Subscriber Translation Function to 
perform the translation to verinym. 

5.4.3.2 Location Subscriber Translation Function (LSTF) 

The Location Subscriber Translation Function (LSTF) is responsible for the mapping between pseudonyms and 
verinyms of the target UE. 

5.4.3.3 Location Subscriber Privacy Function (LSPF) 

The Location Subscriber Privacy function is responsible performs all privacy related authorizations. For a target UE it 
shall authorize the positioning request versus the privacy options of the target UE, if any. 

5.4.4 Positioning components 

The positioning components Positioning Radio Co-ordination Function (PRCF), Positioning Calculation Function 
(PCF), Positioning Signal Measurement Function (PSMF) and Positioning Radio Resource Management (PRRM) are 
described in documents specific to each Access Network type. 

For location services for GSM and UMTS, the Access Network shall send the result of the positioning to the core 
network in geographical co-ordinates as defined in TS 23.032 [11]. For location services for EPS (for E-UTRAN 
access), the E-SMLC shall determine the result of the positioning in geographical co-ordinates as defined in 
TS 23.032 [11]. If requested and if available, the positioning result may also include the velocity of the UE as defined in 
TS 23.032 [11]. The Access Network or E-SMLC shall map the cell(s) the Target UE is associated with into 
geographical co-ordinates, but this mapping is not standardized. 

These entities are defined in TS 36.305 [42] for E-UTRAN, TS 25.305 [1] for UTRAN and in TS 43.059 [16] for 
GERAN. 

5.5 Information Flows between Client and Server 

Other types of national specific information flows may be supported in addition to the information flow specified here. 

Any of the information flows here indicated may not be externally realized if the information does not flow over an 
open interface. 

5.5.1 Location Service Request 

Via the Location Service Request, the LCS client communicates with the LCS server to request for the location 
information of one or more than one UE within a specified quality of service. There exist two types of location service 
requests: 

Location Immediate Request (LIR); and 

Location Deferred Request (LDR). 

The attributes for the information exchange between the LCS Client and the LCS Server have been standardized by 
OMAinMLP[31]. 

The following attributes are identified for Location Service Request information flow: 

Target UE identity (either verinym or pseudonym); 

- LCS Client identity; 
Service identity, if needed; 

- Response method (SYNC or AS YNC), if needed; 
Codeword, if needed; 
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Requestor identity, if needed (and type of Requestor identity if available); 

Number dialled by the target mobile user or APN-NI, if the request is call or session related; 

Type of Event definition, i.e. UE available, change of area or periodic location, applicable to deferred location 
requests only; 

Definitions for change of area type deferred location requests. Following parameters may be defined, if needed; 

a) Indication for event trigger, i.e. UE enters, leaves or is within requested target area; 

b) Indication of either a single event report or multiple event reports; 

c) Minimum interval time between area event reports, if multiple event reports is requested; 

d) Indication of the requested location estimate; i.e. whether the location estimate of the target UE should be 
contained in the change of area event report; 

Definitions for periodic location type deferred location requests. Following parameters may be defined, if 
needed: 

a) Time interval between successive location reports; 

b) Total number of reports; 

Start time, stop time (i.e. specifying the validity time of LCS request), if needed; 

Interval, applicable to periodical requests only; 

Requested Quality of Service information, if needed, i.e. accuracy, response time and LCS QoS Class; 

Requested type of location, i.e. "current location", "current or last known location" or "initial location" 
applicable to LIR only (current location is only available for LDR); 

Velocity of the UE, if needed; 

Priority, if needed; 

Service coverage (i.e. E.164 country codes for geographic areas [35a]), if needed; 

Requested maximum age of location, if needed; 

Local coordinate reference system, if needed; 

Target area, i.e. geographical area expressed as one of the following format, if needed. 

a) a shape defined in TS 23.032 [1 1] 

b) local coordinate system 

c) E.164 country code for a geographic area [35a] 

d) PLMN identity 

e) geopolitical name of the area (e.g. London) 

Some of the information may be stored in GMLC and the LCS client does not need to include such information 
in the location service request. 

5.5.2 Location Service Response 

The LCS server (GMLC) sends the Location Service Response to the LCS client either as an: 
Immediate Response; or a 
Deferred Response, these deferred responses can be either single or periodic. 
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The following attributes are identified for the Location Service Response information flow: 

Location indication of UE in geographical coordinates expressed as a shape as defined in TS 23.032 [11] or local 
coordinate system; 

Velocity of the UE as defined in TS 23 .032 [ 11 ] , if requested and if available; 

The information about the positioning method used to obtain the location estimate of the UE, if it is available at 
the LCS server and if needed; 

Time stamp of location estimate; 

Indication when UE enters, is within or leaves the Geographical area, if needed; 

Acknowledgement for a deferred location request, if needed. 

Request id, if needed. 

LDR reference number, if needed. 

Indication that the requested QoS was not met, if needed, only applicable if the request was for best effort class 

In addition the information attributes of the location service request may be used also in the location service response. 

5.6 Information Flows between LCS Servers 

Other types of national specific information flows may be supported in addition to the information flow specified here. 

Any of the information flows here indicated may not be externally realized if the information does not flow over an 
open interface. 

When the LCS server's associated GMLC uses the Lr interface then this interface shall conform to the procedures 
defined in clause 9 of the current specification. 



5.6.1 Location Service Request 



Via the Location Service Request, the source LCS server communicates with the destination LCS server to request for 
the location information of one UE within a specified quality of service. There exist two types of location service 
requests: 

Location Immediate Request (LIR); and 

Location Deferred Request (LDR). 
The attributes for the information exchange between the LCS Servers have been standardized by DMA in RLP [36]. 
The following attributes are identified for Location Service Request information flow: 

- Target UE identity, (either one or both of MSISDN and IMSI, or SIP-URI, or pseudonym); 
LCS Client identity, i.e. LCS client external identity or internal identity; 

LCS Client type, (i.e. Value added. Emergency, PLMN operator or Lawful interception); 
LCS Client name, if needed (and type of LCS client name if available); 
Service type, if needed; 

- Response method (SYNC or AS YNC), if needed; 
Codeword, if needed; 

Requestor identity, if needed (and type of Requestor identity if available); 

Number dialled by the target mobile user or APN-NI, if the request is call or session related; 
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Type of Event definition, i.e. UE available, change of area or periodic location, applicable to deferred location 
requests only; 

Definitions for change of area type deferred location requests. Following parameters may be defined, if needed; 

a) Indication for event trigger, i.e. UE enters, leaves or is within requested target area; 

b) Indication of either a single event report or multiple event reports; 

c) Minimum interval time between area event reports; 

d) Start time, stop time, i.e. specifying the validity time of LCS area event request; 

Definitions for periodic location type deferred location requests. Following parameters may be defined, if 
needed: 

a) Time interval between successive location reports; 

b) Total number of reports; 

c) Indication of whether MO-LR Short Circuit is permitted; 

d) Reporting PLMN list; 

Requested Quality of Service information, if needed, i.e. accuracy, response time and LCS QoS Class; 

Requested type of location, i.e. "current location", "current or last known location" or "initial location" 
applicable to LIR only (current location is only available for LDR); 

Velocity of the UE, if needed; 

Priority, if needed; 

Requested maximum age of location, if needed; 

Privacy override indicator, if needed; 

Service coverage (i.e. E.164 country codes for geographic areas [35a]), if needed; 

Indicator of privacy check related actions, if needed; 

Supported GAD shapes, if needed; 

- HPLMN LCS server address, i.e. H-GMLC address, if needed; 

- VPLMN LCS server address, i.e. V-GMLC address, if needed; 
Network address of Privacy Profile Register, if needed; 
Network numbers of serving nodes; 

LCS capability sets of serving nodes, if needed. 

Target area, i.e. geographical area expressed as one of the following format, if needed. 

a) a shape defined in TS 23.032 [11] 

b) E. 164 country code for a geographic area [35a] 

c) PLMN identity 

LDR reference number, if needed. 



5.6.2 Location Service Response 



The Location Service Response is sent to the source LCS server as the result of the Location Service Request by the 
destination LCS Server: 
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Immediate Response; or a 

Deferred Response, these deferred responses can be either single or periodic. 

The following attributes are identified for the Location Service Response information flow: 

Location indication of UE in geographical coordinates expressed as a shape as defined in TS 23.032 [11]; 

Velocity of the UE as defined in TS 23 .032 [ 11 ] , if requested and if available; 

Indication when UE enters, is within or leaves the geographical area, if needed; 

The information about the positioning method used to obtain the location estimate of the UE, if it is available at 
the LCS server and needed; 

Age of location estimate; 

Acknowledgement for a deferred location request, if needed. 

Request id, if needed 

Indication that the requested QoS was not met, if needed, only applicable if the request was for best effort QoS 
class 

In addition the information attributes of the location service request may be used also in the location service response. 



LCS Architecture 



Figure 6.1 shows the general arrangement of the Location Service feature in GSM, UMTS and EPS. This illustrates, 
generally, the relation of LCS Clients and servers in the core network with the GERAN, UTRAN and E-UTRAN 
Access Networks. The LCS entities within the Access Network communicate with the Core Network (CN) across the A, 
Gb, lu and SI interfaces. Communication among the Access Network LCS entities makes use of the messaging and 
signalling capabilities of the Access Network. 

As part of their service or operation, the LCS Clients may request the location information of UE. There may be more 
than one LCS client. These may be associated with the GSM/UMTS/EPS networks or the Access Networks operated as 
part of a UE application or accessed by the UE through its access to an application (e.g. through the Internet). 

The clients make their requests to a LCS Server. There may be more than one LCS Server. The client must be 
authenticated and the resources of the network must be co-ordinated including the UE and the calculation functions, to 
estimate the location and optionally, velocity of the UE and result returned to the client. As part of this process, 
information from other systems (other Access Networks) can be used. As part of the location information returned to 
the client, an estimate of the accuracy of the estimate and the time-of-day the measurement was made may be provided. 
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NOTE 1 : HSS includes both 2G-HLR and 3G-HLR functionality. LCS is included in the overall network architecture 

in TS 23.002 [20]. 
NOTE 2: As one alternative the LCS client may get location information directly from GMLC, which may contain 

OSA Mobility SOS with support for the OSA user location interfaces. See TS 23.127 [26] and 

TS29.198[27, 28, 29and30]. 
NOTE 3: The PPR functionality may be integrated in GMLC 
NOTE 4: The PMD functionality may be integrated in GMLC or PPR. 
NOTE 5: The LIMS-IWF may optionally be located within the GMLC. 
NOTE 6: LRF may interact with a separate GMLC or contain an integrated GMLC. 
NOTE 7: the SLP, which may be an H-SLP, V-SLP or E-SLP, may optionally be associated with an E-SMLC in order 

to share assistance data for support of both control plane LCS and OMA SUPL for an operator who 

deploys both solutions. Interaction between the E-SMLC and SLP is outside the scope of this TS. 
NOTE 8: The E-UTRAN may also comprise an LMU as noted in TS 36.300 [50] which interacts with an E-SMLC via 

the SLm interface. This LMU may be standalone or integrated into an eNodeB, as noted in TS 36.305 [42]. 

Figure 6.1-1 : General arrangement of LCS 

Figure 6.1-la shows the general arrangement of the Location Service feature in I-WLAN. This illustrates, generally, the 
relation of LCS Clients and servers in the core network with the WLAN Access Networks. 
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The shaded area refers to WLAN 3GPP IP Access functionality. 

The LCS La interface is added to support LCS for l-WLAN 

The GMLC can have the SLP functionality or GIVILC can be connected to the SLP. 

For l-WLAN emergency location determination, the Ml Interface between E-CSCF and LRF will be used. 

For roaming scenario, the Lr will be used. 

Figure 6.1-la: General arrangement of LCS for l-WLAN 
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NOTE 1 : LRF may interact with a separate GIVILC or contain an integrated GMLC. 

NOTE 2: the SLP, which may be an H-SLP, V-SLP or E-SLP, may optionally be associated with an E-SMLC in order 
to share assistance data for support of both control plane LCS and OMA SUPL for an operator who 
deploys both solutions. Interaction between the E-SMLC and SLP is outside the scope of this TS. 

NOTE 3: The E-UTRAN may also comprise an LMU as noted in TS 36.300 [50] which interacts with an E-SMLC via 
the SLm interface. This LMU may be standalone or integrated into an eNodeB, as noted in TS 36.305 [42]. 

Figure 6.1-2: General arrangement of LCS with inter-GMLC and LIMS-IWF [Lr] interface 
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6.1 Schematic functional description of LCS operations 

The allocation of LCS functional blocks to the Client, LCS server, Core Network, Access Network and UE is based on 
the schematic functional description below. The detailed functions and interactions are specified later in the present 
document and in TS 36.305 [42] for E-UTRAN, TS 25.305 [1] for UTRAN, in TS 43.059 [16] for GERAN and in 
corresponding Stage 3 specifications. 

The operation begins with a LCS Client requesting location information for a UE from the LCS server. The LCS server 
will pass the request to the LCS functional entities in the core network. The LCS functional entities in the core network 
shall then: 

verify that the LCS Client is authorized to request the location of the UE or subscriber; 

verify that LCS is supported by the UE; 

establish whether it is allowed to locate the UE or subscriber, for privacy or other reasons; 

establish which network element in the Access Network for GERAN or UTRAN, or EPC for E-UTRAN, should 
receive the Location request; 

- request the Access Network (via the A, Gb or lu interface) for GERAN or UTRAN, or the E-SMLC (via the SLs 
interface) for E-UTRAN, to provide location information for an identified UE, with indicated QoS; 

receive information about the location of the UE from the Access Network or E-SMLC and forward it to the 
Client; 

send appropriate accounting information to an accounting function. 

The Access Network LCS functional entities shall determine the position of the target UE according to TS 36.305 [42] 
for E-UTRAN, TS 25.305 [1] for UTRAN and TS 43.059 [16] for GERAN. 

6.2 Allocation of LCS functions to network elements 

Table 6.1 shows a summary of the Functional Groups and Functional Blocks for Location services. Table 6.2 and 
figure 6.2 show the generic configuration for LCS and the distribution of LCS functional blocks to network elements. 
Different positioning methods, including network-based, mobile-based, mobile-assisted and network-assisted 
positioning methods may be used. With this configuration both the network and the mobiles are able to measure the 
timing of signals and compute the mobile's location estimate. Depending on the applied positioning method it is 
possible to utilise the corresponding configuration containing all needed entities. For instance, if network-based 
positioning is applied, the entities that are involved in measuring the mobile's signal and calculating its location estimate 
are allocated to the network elements of the access stratum. On the other hand, in case mobile-based or network-assisted 
methods are used these entities should be allocated to the UE. 

LCS is logically implemented on the network structure through the addition of one network node, the Mobile Location 
Centre (MLC). It is necessary to name a number of new interfaces. The LCS generic architecture can be combined to 
produce LCS architecture variants. 
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Table 6.1 : Summary of Functional Groups and Functional Blocks for Location services 



Funct. 
Group 


Functional 
component 


Full name of Functional Block 


Abbrev. 


Loc. 
Client 


Location Client 
Component 


(External) Location Client Function 


LCF 


Internal Location Client Function 


LCF 
-internal 


LCS 

Server 

in PLMN 


Client handling 
component 


Location Client Control Function 


LCCF 


Location Client Authorization Function 


LCAF 


Location Client Co-ordinate Transformation Function 


LCCTF 


Location Client Zone Transformation Function 


LCZTF 


System handling 
component 


Location System Control Function 


LSCF 


Location System Billing Function 


LSBF 


Location System Operations Function 


LSOF 


Location System Broadcast Function 


LSBcF 


Location System Co-ordinate Transformation Function 


LSCTF 


Location IIVIS - Interworking Function 


LIMS-IWF 


Subscriber 

Handling 

component 


Location Subscriber Authorization Function 


LSAF 


Location Subscriber Translation Function 


LSTF 


Location Subscriber Privacy function 


LSPF 


Positioning 
component 


Positioning Radio Control Function 


PRCF 


Positioning Calculation Function 


PCF 


Positioning Signal Measurement Function 


PSMF 


Positioning Radio Resource IVIanagement 


PRRM 



Tables 6.2 and 6.2a and figure 6.2 illustrate the allocation of functional entities in the reference configuration of LCS. It 
is assumed that the CS and PS have either their own independent mobility management or use the joint mobility 
management through the optional Gs interface. 

It is also seen that LCS may take benefit of the lur interface between RNCs, when uplink radio information and 
measurement results are collected. 

The functional model presented in the figure includes functional entities for both CS and PS related LCS. In addition, it 
consists of all the entities needed for different positioning methods, i.e. network based, mobile based, mobile assisted, 
and network assisted positioning, exploiting either uplink or downlink measurements. Similarly, the velocity of a UE 
may be calculated in either the network or the UE. It is noted that the UE may use e.g. the GPS positioning mechanism, 
but still demand e.g. auxiliary measurements from the serving network. RAN specific functional entities are specified in 
TS 36.305 [42] for E-UTRAN, TS 25.305 [1] for UTRAN and in TS 43.059 [16] for GERAN. 
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Table 6.2: Allocation of LCS functional entities to network elements 





UE 


RAN 


GMLC 


SGSN 


MSC/MSC 
Server 


HLR/HSS 


PPR 


PMD 


Client 


Location client functions 


LCF 


X 






X 


X 








X 


LCF 
Internal 




X 
















Client handling functions 


LCCTF 






X 














LCCF 






X 














LCAF 






X 














LCZTF 






X 














System handling functions 


LSCF 




X 




X 


X 






























LSBF 






X 


X 


X 










LSOF 


X 


X 


X 


X 


X 










LSBcF 




X 
















LSCTF 






X 














LIMS-IWF 






X(Notel) 














Subscriber handling functions 


LSAF 






X 


X 


X 




X 






LSPF 






X 


X 


X 


X 


X 






LSTF 
















X 




Positioning functions 


PRCF 




X 
















PCF 


X 


X 
















PSMF 


X 


X 
















PRRM 




X 


















UE 


RAN 


GMLC 


SGSN 


MSC/MSC 
Server 


HLR/HSS 


PPR 


PMD 


Client 



NOTE 1 : The LIMS-IWF may optionally be located within the GMLC. If it is not located within the GMLC, it shall use 

the Le or Lr reference point to interface to the GMLC. 
NOTE 2: The functional entities shown for the RAN are valid for GSM and UMTS but not EPS. 
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Table 6.2a: Allocation of LCS functional entities to EPS elements 



UE RAN 1 GMLC MME E-SMLC HLR/HSS PPR PMD Client 


Location client functions 


LCF 


X 






X 










X 


LCF 
Internal 




















Client handling functions 


LCCTF 






X 














LCCF 






X 














LCAF 






X 














LCZTF 






X 














System handling functions 


LSCF 








X 












LSBF 






X 


X 












LSOF 


X 


X 


X 


X 


X 










LSBcF 




X 






X 










LSCTF 






X 














LIMS-IWF 






X(Notel) 














Subscriber handling functions 


LSAF 






X 


X 






X 






LSPF 






X 


X 




X 


X 






LSTF 
















X 




Positioning functions 


PRCF 










X 










PCF 


X 








X 










PSMF 


X 


X 
















PRRM 




X 


















UE 


RAN 


GMLC 


MME 


E-SMLC 


HLR/HSS 


PPR 


PMD 


Client 



NOTE 1 : The LIMS-IWF may optionally be located within the GMLC. If it is not located within the GMLC, it shall use 
the Le or Lr reference point to interface to the GMLC. 
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NOTE 1 : The LIMS-IWF may optionally be located within the GIVILC. If it is not located within the GI\/ILC, it shall use 
the Le or Lr reference point to interface to the GI\/ILC. 

Figure 6.2: Generic LCS Logical Architecture 

6.3 Functional description of LCS per network element 
6.3.1 Access Network 

The Access Network is involved in the handling of various positioning procedures. 
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The LCS specific functionalities of the radio access network elements are specified in TS 36.305 [42] for E-UTRAN, 
TS 25.305 [1] for UTRAN and TS 43.059 [16] for GERAN. 

6.3.2 LCS Clients, LCS applications and Requestors 

There are two classes of LCS Application - Internal applications and External applications. Internal applications 
represent entities internal to the GSM/UMTS/EPC that make use of location information for the (improved) operation 
of the network. Internal LCS client can be identified by LCS client internal ID. LCS client Internal ID distinguishes the 
following classes: (LCS client broadcasting location related information, O&M LCS client in the HPLMN, O&M LCS 
client in the VPLMN, LCS client recording anonymous location information, LCS Client supporting a bearer service, 
teleservice or supplementary service to the target UE). External applications represent entities (such as Commercial or 
Emergency services) that make use of location information for operations external to the mobile communications 
network. External LCS client can be identified by LCS client external ID. The LCS Applications interface to the LCS 
entities through their Location Client functions (LCF). Location requests from the external LCS clients may be 
originated by external entities (i.e. Requestor). LCS client should authenticate the Requestor Identity but this is outside 
the scope of this specification. 

LCS client may indicate the type of the Requestor identity in the LCS service request. The type of the Requestor 
identity can be one of the following: 

Logical name 

- MSISDN [17] 
E-mail address [33] 

- URL [33] 

- SIP URL [34] 

- IMS pubUc identity [35] 

The LCS Client, LCS applications and Requestors are outside the scope of the present document. 

6.3.3 Gateway Mobile Location Centre, GMLC 

The Gateway Mobile Location Centre (GMLC) contains functionality required to support LCS. In one PLMN, there 
may be more than one GMLC. 

A GMLC is the first node an external LCS client accesses in a PLMN (i.e. the Le reference point is supported by the 
GMLC). The GMLC may request routing information from the HLR via the Lh interface or HSS via the SLh/Lh 
interface. After performing registration authorization, it sends positioning requests to either VMSC, SGSN, MSC Server 
or MME and receives final location estimates from the corresponding entity via the Lg or SLg interface. Information 
needed for authorisation, location service requests and location information may be communicated between GMLCs, 
located in the same or different PLMNs, via the Lr interface. The target UE's privacy profile settings shall always be 
checked in the UE's home PLMN prior to delivering a location estimate. In order to allow location request from a 
GMLC outside the HPLMN while having privacy check in the HPLMN, the Lr interface is needed. 

The "Requesting GMLC" is the GMLC, which receives the request from LCS client. 

The "Visited GMLC" is the GMLC, which is associated with the serving node of the target mobile. 

The "Home GMLC" is the GMLC residing in the target mobile's home PLMN, which is responsible for the control of 
privacy checking of the target mobile. 

The Requesting GMLC can be the Visited GMLC, and either one or both of which can be the Home GMLC at the same 
time. 

6.3.3A Location Retrieval Function, LRF 

Location Retrieval Function (LRF) may be collocated with the GMLC or separate and is responsible for retrieving or 
validating location information, providing routing and/or correlation info of an UE that has initiated an IMS emergency 
session. The information is provided to the E-CSCF via the Ml interface. For detail, refer to TS 23.167 [36a]. 



£75/ 



3GPP TS 23.271 version 11.1.0 Release 1 1 40 ETSI TS 1 23 271 V1 1 .1 .0 (201 3-01 ) 



6.3.4 LCS support in the UE 



The UE may be involved in the various positioning procedures. Specific UE involvement is specified in each of the 
positioning procedures specified in TS 36.305 [42] in E-UTRAN, TS 25.305 [1] for UTRAN and TS 43.059 [16] for 
GERAN. 

The UE interacts with the measurement co-ordination functions to transmit the needed signals for uplink based LCS 
measurements and to make measurements of downlink signals. The measurements to be made will be determined by the 
chosen location method. 

The UE may also contain LCS applications, or access a LCS application through communication with a network 
accessed by the UE or an application residing in the UE. This application may include the needed measurement and 
calculation functions to determine the UE's location with or without assistance of the GSM/UMTS/EPS LCS entities. 

In GSM the positioning methods supported by the UE are signalled by the UE to the core network and radio access 
network using Classmark3 in CS mode, as specified in TS 24.008 [24]. 

In UMTS the UE capability to support different positioning methods is only communicated within UTRAN, as 
specified in TS 25.331 [25]. 

In EPS the positioning methods supported by the UE may be signalled by the UE to the core network using LPP by the 
initial location service invocation as specified in TS 36.305 [42]. Also, in EPS the UE capabilities to support LCS 
Notification for an MT-LR and LPP for positioning are exchanged at the initial EPS attach procedure. The indication of 
the UE LPP capabihty will be forwarded by MME to E-SMLC as specified in TS 29. 171 [46]. 

The UE informs the core network about its capability to support privacy invocation request and response using 
Classmark2 in CS mode and MS Network Capability in PS mode, as specified in TS 24.008 [24]. 

The UE may also, for example, contain an independent location function (e.g. Global Satellite Positioning Service GPS) 
and thus be able to report its location, independent of the RAN transmissions. The UE with an independent location 
function may also make use of information broadcast by the RAN that assists the function. 

The UE may support multiple simultaneous location sessions. 

6.3.5 MSC/VLR 

The MSC/VLR contains functionality responsible for UE subscription authorization and managing call-related and 
non-call related positioning requests of LCS. The MSC is accessible to the GMLC via the Lg interface. The LCS 
functions of MSC are related to charging and billing, LCS co-ordination, location request, authorization and operation 
of the LCS services. If connected to SGSN through the Gs interface, it checks whether the UE is GPRS attached to 
decide whether to page the UE on the A/Iu or Gs interface. 

The MSC/VLR may inform HLR/HSS about the UE's LCS Capabilities and may include the IP address of the V-GMLC 
associated with the MSC/VLR in the MAP UPDATE LOCATION message, during Registration and Inter MSC Update 
Location procedures. 

6.3.6 MSC Server 

The MSC Server handles the same functionality as the MSC/VLR including charging and billing, LCS co-ordination, 
location request, authorization and operation of the LCS services. The MSC Server is accessible to the GMLC via the 
Lg interface. 

6.3.7 SGSN 

The SGSN contains functionality responsible for UE subscription authorization and managing positioning requests of 
LCS. The SGSN is accessible to the GMLC via the Lg interface. The LCS functions of SGSN are related to charging 
and billing, LCS co-ordination, location request, authorization and operation of the LCS services. 

The SGSN may inform HLR/HSS about the UE's LCS Capabilities for GPRS and may include the IP address of the V- 
GMLC associated with the SGSN in the MAP UPDATE GPRS LOCATION message, during Attach and Inter SGSN 
Routing Area Update procedures. 
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The SGSN forwards the circuit-switched paging request received from the Gs interface to the BSS/RNC. 

6.3.8 Home Location Register, HLR 

The HLR contains LCS subscription data and routing information. The HLR is accessible from the GMLC via the Lh 
interface. For a roaming UE, HLR may be in a different PLMN. 

6.3.9 HSS 

The HSS contains LCS subscription data and routing information. The HSS is accessible from the GMLC via the 
Lh/SLh interface. For roaming UEs, HSS may be in a different PLMN. 



6.3.10 gsmSCF 

The Lc interface supports CAMEL access to LCS and is applicable in CAMEL Phase 3 and later. The procedures and 
signalling associated with it are defined in TS 23.078 [21] and TS 29.002 [18], respectively. 

6.3.1 1 Privacy Profile Register, PPR 

Privacy check may be done in the privacy profile register. The HLR or HSS contains the address to the PPR. The PPR 
is accessible from the H-GMLC via the Lpp interface. PPR may be a standalone network entity or the PPR functionality 
may be integrated in H-GMLC. 



6.3.12 Pseudonym Mediation Device, PMD 

The pseudonym mediation device (PMD) functionality maps or decrypts the pseudonym into the corresponding 
verinym (i.e. IMSI or MSISDN). PMD functionality may be a standalone network entity or the PMD functionality may 
be integrated in PPR, GMLC or other network entity. If PMD functionality is not part of GMLC it may be accessed 
using the Lid interface. The detail of PMD functionality is out of scope, and only the interface between GMLC and 
PMD functionality is specified in this specification. 

6.3.13 Mobility Management Entity, MME 

The Mobility Management Entity (MME) contains functionality responsible for UE subscription authorization and 
managing positioning requests of LCS. The MME is accessible to the GMLC via the SLg interface. The LCS functions 
of MME are related to charging and billing, LCS co-ordination, E-SMLC selection, location request, authorization and 
operation of the LCS services. 

The MME may inform HLR/HSS about the UE's LCS Capabilities for EPS and may include the IP address of the V- 
GMLC associated with the MME in the Update Location Request message, during Attach and Inter MME Tracking 
Area Update procedures. 

The MME selects an available E-SMLC to serve the location request for a UE. The selection is based on network 
topology and should provide load balancing between E-SMLCs. Other criteria for E-SMLC selection may include LCS 
Client type and requested QoS. 

6.3.14 Evolved Serving Mobile Location Centre, E-SMLC 

The E-SMLC manages the overall co-ordination and scheduling of resources required for the location of a UE that is 
attached to E-UTRAN. It also calculates the final location and velocity estimate and estimates the achieved accuracy. 
The E-SMLC interacts with the UE in order to exchange location information applicable to UE assisted and UE based 
position methods and interacts with the E-UTRAN in order to exchange location information applicable to network 
assisted and network based position methods. 
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6.4 Addressing the target UE for LCS purposes 

6.4.1 Verinyms for the target UE 

It shall be possible to address and indicate the target UE using MSISDN and SIP-URL It may be possible in certain 
cases to address the target UE using IP address when a static or dynamic IP address (IPv4 or IPv6) has been allocated 
for the UE. 

In the mobile terminated location request procedures in the PS domain (as well as in the CS domain), the target UE is 
identified using either MSISDN or IMSI. 

NOTE: It is recognized that IP-addressing of the target UE is only possible when there is an active PDP context 
established between the target UE and the external LCS client. Using the established PDP context, the 
LCS client can request the target UE, as identified with the IP address it currently uses, to initiate a 
Mobile originated location request. The actual signalling exchange between the LCS Client/server and the 
target UE or the user of the target UE is outside the scope of this specification. The resulting MO-LR is 
performed as specified in this document. 

6.4.2 Pseudonyms for the target UE 

National regulations require support for the anonymity of the target mobile user in some countries. It shall therefore be 
possible to address and indicate the target UE using a pseudonym. The pseudonym may be the IMSI or MSISDN of the 
target UE encrypted e.g. using the public key of the home operator. The address of the network element that issued the 
pseudonym, i.e. the PMD address, shall either be attached to the pseudonym, if required or this address can be deduced 
from the pseudonym. The H-GMLC address may also either be attached to the pseudonym or be deduced from the 
pseudonym. It is outside the scope of this specification how the requestor and the LCS client will receive and handle the 
pseudonym, but some examples are described in the informative Annex E. 

6.4.3 Non-dialable callback numbers 

In case of a SIM-less emergency call, or in case of a non-registered (U)SIM emergency call, a non-dialable callback 
number shall be used to identify the target UE. The format and structure of the non-dialable callback number is 
according to national or regional regulations. The non-dialable callback number in North America shall, according to J- 
STD-036 [32], be the digits 91 1 H- the last 7 digits of IMEI expressed in decimal numbers. 

NOTE: The use of non-dialable callback numbers in other parts of the world is for further study. The non-dialable 
callback number should adopt random numbering, if not otherwise unique. 

6.5 Quality of Service Information 

LCS Quality of Service information is characterised by 3 key attributes: 

- LCS QoS Class 

Accuracy 

Response Time 

The use of quality of service to characterise location requests is optional and if not requested the default shall be either 
network operator determined or client negotiated. 

6.5.1 LCS QoS Class 

The LCS QoS Class defines the degree of adherence by the Location Service to another quality of service parameter 
(Accuracy), if requested. The LCS Server shall attempt to satisfy the other quality of service parameter regardless of the 
use of QoS Class. 
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6.5.1.1 Best Effort Class 

This class defines the least stringent requirement on the QoS achieved for a location request. If a location estimate 
obtained does not fulfil the other QoS requirements, it should still be returned but with an appropriate indication that the 
requested QoS was not met. If no location estimate is obtained, an appropriate error cause is sent. 

6.5.1.2 Assured Class 

This class defines the most stringent requirement on the accuracy achieved for a location request. If a location estimate 
obtained does not fulfil the other QoS requirements, then it shall be discarded and an appropriate error cause sent. 



7 Signalling and Interfaces 

7.1 LCS signalling between Access and Core Networks for 
GERAN and UTRAN access networks 

For GERAN and UTRAN access networks, the core network sends location requests to the access network, which then 
sends the corresponding responses back to the core network. 

Communication between access and core networks is accomplished through lu interface in UMTS whereas the A, Gb 
and lu interfaces are used for the purpose in GSM (see TS 25.305 [1] and TS 43.059 [16]). 

7.1 .1 Core network Location Request 

The core network request for a location estimate of a target UE shall contain sufficient information to enable location of 
the Target UE according to the required QoS using any positioning method supported by the PLMN and, where 
necessary, UE. For location services the core network may request the geographical co-ordinates and velocity of the 
Target UE. 

In lu mode the core network may also request in which Service Area the Target UE is located. The Service Area 
information may be used for routing of corresponding Emergency calls, or for CAMEL services. 

In A/Gb mode this corresponds to the usage of Cell ID in the core network. It should be noted that the Service Area 
concept is different from the Localized Service Area concept used for SoLSA services. 

When the location of a Target UE in Idle Mode is requested, the core network shall determine which RAN entity is 
associated with the Target UE. 

7.1.2 Location Report 

The access network reports the location of the Target UE to the core network entities. The location report may contain 
the following information as defined in the corresponding location request: 

the geographical co-ordinates of the Target UE; 

the positioning method used to obtain the location estimate if the access network is either GERAN in the A/Gb 
mode, GERAN in the lu mode or UTRAN in the lu mode. 

the service area in which the Target UE is located; 

achieved quality level of the location estimate; 

velocity estimate of the Target UE, if available; 

achieved quality level of the velocity estimate of the Target UE, if available. 
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7.1 a LCS signalling between Access and Core Networks for E- 
UTRAN access networks 

For E-UTRAN access networks, the MME sends location requests to the E-SMLC via the SLs interface (see clause 7.8). 
The E-SMLC then sends core network measurement requests, as described in clause 7.1a.l, to the access network via 
the MME. The access network sends corresponding network measurement reports, as described in clause 7. la. 2, back to 
the E-SMLC, again via the MME. 

Communication between access and core networks is accomplished through S 1 interface in E-UTRAN (see 
TS 36.305 [42]. 

7.1 a.1 Core network IVIeasurement Request 

The core network request for network measurements shall contain sufficient information to enable the desired 
measurements to be provided by the access network. 

The core network shall determine which RAN entities are associated with the Target UE. 

7.1 a.2 Location IVIeasurement Report 

The access network reports measurements pertaining to the Target UE back to the E-SMLC as defined in the 
corresponding core network measurement request. 

7.2 Um, Uu and Uu-LTE Interfaces 

The Um, Uu and Uu-LTE interfaces are used to communicate among the LCS entities associated with the BSC, RNC, 
the UE and the stand-alone (Type A) Location Measurement Units (LMU). The Um, Uu and Uu-LTE interfaces are also 
used to communicate between the LCS entities in the core network and the UE. 

NOTE: The Type A and Type B LMUs are defined only for GERAN. For LTE, the LMU may be standalone or 
integrated into an eNodeB, as noted in TS 36.305 [42]. 

The Um/Uu/Uu-LTE interfaces may pass measurement requests and results to and from UE or the stand-alone LMU. 

The Um/Uu/Uu-LTE interfaces may also pass location requests from internal or external LCS Clients (Applications) at 
the UE. Note that these requests may require the services of the LCS entities associated with the core network to 
authenticate clients and subscriber subscriptions to aspects of the LCS. 

The Um/Uu/Uu-LTE interfaces may also be used for broadcast of information that may be used by the UE or stand- 
alone LMU for their LCS operations. This may, for example, include timing information about nearby Node-B/BTS 
transmissions that may assist the UE or LMU in making their measurements. In UTRAN code information may be 
included. 

The Um, Uu and Uu-LTE interfaces may also pass messages relating to changes or reporting of the data associated with 
the Location System Operations Function (LSOF) in the UE or the remote LMU. 

UTRAN Stage 2 specification TS 25.305 [1] specifies LCS signalling over the Uu interface and GERAN Stage 2 
specification TS 43.059 [16] specifies LCS signalling over the Um interface correspondingly. E-UTRAN Stage 2 
specification TS 36.305 [42] specifies LCS signalling over the Uu-LTE interface. 

Message segmentation is specified in GERAN LCS Stage 2, TS 43.059 [16]. 

7.3 MAP Interfaces 

The following interfaces are based on MAP in LCS. 

Lh interface: interface between GMLC and HSS. This interface is used by the GMLC to request the address of 
the H-GMLC, and/or the address of the visited MSC or SGSN for a particular target UE whose location has been 
requested 
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- Lg interface: interface between GMLC MSC and GMLC - SGSN. This interface is used by the GMLC to convey 
a location request to the MSC or SGSN currently serving a particular target UE whose location was requested. 
The interface is used by the MSC or SGSN to return location results to the GMLC. 

Lc interface: interface between GMLC and gsmSCF, CAMEL. This interface is used to get location information 
for CAMEL based services. 

The following MAP services are defined for LCS. 

- MAP-SEND-ROUTING-INFO-FOR-LCS Service. 

This service is used between the GMLC and the HLR/HSS to retrieve the routing information needed for routing a 
location service request to the serving VMSC , SGSN. The service may be used in GMLC - HSS interface to retrieve 
routing information in order to route the location service request to the correct VMSC, SGSN and MSC Server. 

In case the service is used between the R-GMLC and the HSS, the H-GMLC address of the target UE to be located is 
retrieved. The address of the V-GMLC associated with the serving node and PPR may also be retrieved. 

- MAP-PROVIDE-SUBSCRIBER-LOCATION Service. 

This service is used by a GMLC to request the location and optionally, velocity, of a target UE from the visited MSC, 
SGSN or MSC Server at any time. 

- MAP-SUBSCRIBER-LOCATION-REPORT Service. 

This service is used by a VMSC, SGSN or MSC Server to provide the location of a target UE to a GMLC when a 
request for location is either implicitly administered or made at some earlier time. 

The MAP Subscriber Location Report could also be used to send information about location and, if requested and 
available, velocity of the Target UE (for MO-LR) to an external client. 



7.4 Lpp interface 



Lpp is the interface between H-GMLC and PPR. If the UE subscribers LCS privacy information is kept in the PPR this 
interface is used by the H-GMLC to request the PPR to perform a privacy check. The Lpp interface shall conform to the 
protocol as specified in (reference to be added) and the procedures defined in clause 9 of this specification. 

7.4.1 LCS Authorisation Request 

Via the LCS Authorisation Request, the H-GMLC can request the PPR to perform the privacy check. There exist two 
types of LCS Authorisation Request: 

LCS Authorisation Request without location estimate (send by H-GMLC before location request); 

LCS Authorisation Request with location estimate (to check location related privacy settings). 

The following attributes are identified for LCS Authorisation Request information flow: 

- Target UE identity, (one or both of MSISDN and IMSI), if needed; 

If PPR contains PMD functionality the LCS Authorisation Request may contain the same information as the 
LCS Identity request, i.e. the pseudonym of the target UE, if needed. 

Indication on call/session related MT-LR; 

LCS Client identity, i.e. LCS client external identity or internal identity; 

LCS Client type, (i.e. Value added. Emergency, PLMN operator or Lawful interception); 

LCS Client name, if needed (and type of LCS client name if available); 

Service type, if needed; 

Codeword, if needed; 
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Requestor identity, if needed (and type of Requestor identity if available); 

Type of location, i.e. "current location", "current or last known location" or "initial location"; 

Velocity of the UE, if needed; 

LCS capability sets of serving nodes, if needed; 

Location estimate, if needed and available (This is only relevant for LCS Authorisation Request with location 
estimate); 

Type of Deferred Location Request, if needed (i.e. UE available. Change of Area or Periodic Location); 

Geographic area for change of area event, if needed; 

Parameters for Periodic Location event, if needed (i.e. reporting interval, total number of reports, request for 
MO-LR short circuit). 

7.4.2 LCS Authorisation Response 

The LCS Authorisation Response is sent by the PPR to the H-GMLC as the result for the LCS Authorisation Request. 

The following attributes are identified for the LCS Authorisation Response information flow: 

Indicator for location request is to be barred, if needed. If this is set, no other indicators shall be included in the 
response; 

Indicator for call/session related class of privacy check related actions, if needed; 

positioning not allowed; 

positioning allowed without notifying the UE user; 

positioning allowed with notification to the UE user; 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

Indicator for call/session unrelated class of privacy check related actions, if needed; 

positioning not allowed; 

positioning allowed without notifying the UE user; 

positioning allowed with notification to the UE user; 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

Pseudo external ID, if needed (see Annex C); 

Indicator on additional privacy check with location estimate, if needed; 

Indicator on additional notification/verification by the UE user without positioning (existing location estimate to 
be returned to the LCS Client if this is successful), if needed; 

Same information as in the LCS Identity Response, in case the PMD is integrated in PPR, if needed; 

Indicator for MO-LR short circuit allowed/not allowed, if needed. 
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7.4.3 LCS Privacy Profile Update notification 

The LCS Privacy Profile Update notification is sent to the H-GMLC from the PPR in order to notify the H-GMLC 
about the change of UEs privacy profile. 

- Target UE identity, (one or both of MSISDN and IMSI); 
Indication on the changed UEs privacy profile 

7.4.4 LCS Privacy Profile Update notification ack 

The LCS Privacy Profile Update notification ack. is sent to the PPR as the result of the LCS Privacy Profile Update 
Request by H-GMLC. 

Acknowledgement 

7.5 Lid interface 

Lid is the interface between H-GMLC and PMD. If the UE subscribers pseudonym can be mapped or decrypted to the 
corresponding verinym in the standalone PMD. The Lid interface shall conform to the protocol as specified in 
(reference to be added) and the procedures defined in clause 9 of this specification. 

7.5.1 LCS Identity Request 

Via the LCS Identity Request, the H-GMLC can request the PMD to retrieve the verinym of the subscriber. 
The following attribute is identified for the LCS Identity Request: 

- Pseudonym; 

7.5.2 LCS Identity Response 

The PMD sends the LCS Identity Response to the H-GMLC as a result of the LCS Identity Request by the H-GMLC. 
The following attribute is identified for the LCS Identity Response information flow: 

- Target UE identity, (one or both of MSISDN and IMSI); 

7.6 IMS related Interfaces 

7.6.1 Dh Interface 

Dh is the interface between LIMS-IWF and SLF. The purpose of this interface is to retrieve the address of the correct 
HSS serving the user. Dh is an optional interface. 

7.6.2 Sh Interface 

Sh is the interface between LIMS-IWF and HSS. The purpose of this interface is to retrieve the user's MSISDN. 

7.6.3 Ml Interface 

Ml is the interface between the E-CSCF and LRF. For details, refer to TS 23. 167 [36a]. 



7.7 SLg Interface 



SLg is the interface is used by the GMLC to convey a location request to the MME currently serving a particular target 
UE whose location was requested. The interface is also used by the MME to return location results to the GMLC. 
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7.8 SLs Interface 

SLs is the interface between the MME and the E-SMLC. This interface is used to convey location requests from the 
MME to the E-SMLC and to convey corresponding location reports back from the E-SMLC to the MME. 

It is also used for tunnelling core network measurement requests from the E-SMLC to the RAN, using RAN specified 
protocols transparent to the MME as described in TS 36.305 [42]. 

7.9 SLh Interface 

SLh is the Diameter based interface between the HSS and the GMLC as described in TS 29.173 [45]. 

7.10 SLm Interface 

SLm is the interface between the E-SMLC and the LMU. This interface allows the E-SMLC to exchange measurement 
information with the LMU for the purpose of UTDOA positioning as described in TS 36.305 [42]. 



8 General network location procedures 

8.1 State description for GMLC 
8.1.1 GMLC states 

8.1.1.1 NULL state 

In the NULL state, a particular location request from some LCS client either has not been received yet or has already 
been completed. After a location request is received from a LCS client, the GMLC remains in the NULL state while the 
identity of the client and nature of its location request are verified. While the NULL state exists conceptually, it need 
not be represented explicitly in the GMLC. 

8.1 .1 .2 INTERROGATION State 

In this state, the GMLC has sent an interrogation to the home HLR/HSS of the UE to be located and is awaiting a 
response giving one or several of the following addresses: the VMSC, MSC Server, SGSN address, MME address and 
IMSI for this UE. 

8.1.1.3 LOCATION State 

In this state, the GMLC has sent a location request to the VMSC, MSC Server, SGSN or MME serving the UE to be 
located and is awaiting a response containing a location estimate. Optionally, location information may also be 
communicated between GMLCs, located in the same or a different PLMN, via the GMLC to GMLC Lr interface 
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8.1.2 State functionality 
8.1.2.1 State Transitions 



Location Request - 

Interrogate HLR/HSS 

for 

GMLC/VMSC/SGSN'MME/M: 

Server address 



Location Request - 
GMLC l^nows VGMLC/VIVISC 
/SGSN/IVIME/MSC Server 
address 




Receive 
VGIVILCA/IVISG/SGSN/MIVIE/IVISG ' 
Server address from 
HLR/HSS 

Figure 8.1 : State Transitions in thie GIVILC 

Moving from NULL to INTERROGATION state: 

If the GMLC does not know any of the following addresses: VMSC, MSC Server, SGSN, MME, V-GMLC address or 
IMSI when it receives a location service request from some LCS client, it moves from the NULL state to the 
INTERROGATION state and sends a request to the UE's home HLR/HSS for the VMSC/ MSC Server/ SGSN /MME/ 
V-GMLC address and IMSI. 

Moving from NULL to LOCATION state: 

If the GMLC already knows one of the following addresses: VMSC, MSC Server, SGSN, MME or UE IMSI, when it 
receives a location service request from some LCS client (e.g. from information retained for an earlier location request 
for the same UE), it moves from the NULL state to the LOCATION state and sends a location request to either the 
VMSC, MSC Server, SGSN, or MME. Optionally, it may send the location request to another GMLC via the Lr 
interface. 

NOTE: It is for further study how GMLC selects if it shall send the location request to VMSC, MSC server, 
SGSN, and/or MME in different cases. This should be specified in the signalling procedures. 

Moving from INTERROGATION to LOCATION state: 

After the GMLC, in the INTERROGATION state, receives one or several of the addresses VMSC, MSC Server, SGSN, 
MME, V-GMLC and IMSI from the home HLR/HSS, it enters the LOCATION state and sends a location request to 
either the VMSC, MSC Server, SGSN, MME or V-GMLC of the UE being located. 

Moving from LOCATION to NULL state: 

After the GMLC receives a location estimate response from the VMSC, MSC Server, SGSN, MME or V_GMLC, it 
forwards the location estimate to the requesting LCS client and re-enters the NULL state. 



8.1.2.2 



INTERROGATION Timer Function 



The GMLC runs a timer while in the INTERROGATION state to limit the amount of time waiting for an interrogation 
response from the HLR/HSS. If the timer expires before an interrogation response is received, the GMLC indicates a 
location failure to the LCS client and re-enters the NULL state. 
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8.1.2.3 



LOCATION Timer Function 



The GMLC runs a timer while in the LOCATION state to Hmit the amount of time waiting for a location estimate 
response from the VMSC/ MSC Server /SGSN/MME. If the timer expires before a response is received, the GMLC 
indicates a location failure to the LCS client and re-enters the NULL state. 



8.2 State description for VIVISC and IVISC Server 
8.2.1 VIVISC and MSC Server States 



8.2.1.1 



LCS IDLE State 



In this state, the VMSC/MSC Server location service is inactive for a particular UE. The UE may be known in the 
VMSC/MSC Server (except for a USIM less or SIM less Emergency call or where the UE information has been 
cancelled or lost in the VMSC/MSC Server), but there may not be an active Mobility Management to the UE. 

8.2.1.2 LOCATION State 

In this state, the VMSC/MSC Server is awaiting a response from RAN after requesting the location for a particular UE. 

8.2.2 State Functionality 
8.2.2.1 State Transitions 



Request 
Location fro 
the RAN 




Receive 
Location 
results from the 
RAN or 
Timeout 



Transfer 

Positioning 

Messages 



Figure 8.2: State Transitions in the VIUISC/IUISC Server 

Moving from LCS IDLE to LOCATION state: 

After a request has been received to locate a particular UE and the UE subscription options have been verified, a 
location request is sent to the RAN of the UE to be located: the VMSC/MSC Server then enters the LOCATION state. 
Before entering this state, the VMSC/MSC Server must have setup a Mobility Management connection to the UE if 
none was previously active. The mobile is paged and authenticated before positioning. 

Moving from LOCATION to LCS IDLE state: 

After the return of a location estimate result from RAN, the VMSC/MSC Server shall re-enter IDLE state. 
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8.2.2.2 



LOCATION Timer Function 



The VMSC/MSC Server runs a timer while in the LOCATION state to limit the amount of time waiting for a location 
response from the RAN. If the timer expires before such information is received, the VMSC/MSC Server indicates a 
location failure to the original requesting entity and re-enters IDLE state. 

8.3 LCS State description for SGSN 
8.3.1 SGSN States 



8.3.1.1 



LCS IDLE State 



In this state, the SGSN location service is inactive for a particular UE. The UE is known in the SGSN except in case 
where the UE data has been cancelled or lost in the SGSN. There is not an active Mobility Management to the UE. 



8.3.1.2 



LOCATION State 



In this state, the SGSN is awaiting a response from the RAN after requesting the location for a particular UE. In this 
state, a Mobility Management connection to the target UE will be active. 

8.3.2 State Functionality 
8.3.2.1 State Transitions 
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Figure 8.3: State Transitions in the SGSN 

Moving from LCS-IDLE to LOCATION state: 

After a request has been received to locate a particular UE and the UE subscription options have been verified to allow 
this, the SGSN sends a location request to the RAN. The SGSN then enters the LOCATION state. Before entering this 
state, the SGSN must have setup a Mobility Management connection to the UE if none was previously active. The 
mobile is paged and authenticated before positioning. 

Moving from LOCATION to LCS IDLE state: 

After the return of a location estimate result from RAN, or if the Location Timer described below expires, the SGSN 
shall re-enter IDLE state. 



£75/ 



3GPP TS 23.271 version 1 1 .1 .0 Release 1 1 52 ETSI TS 1 23 271 V1 1 .1 .0 (201 3-01 ) 

8.3.2.2 LOCATION Timer Function 

The SGSN runs a timer while in the LOCATION state to limit the amount of time waiting for a location response from 
the RAN. If the timer expires before such information is received, the SGSN indicates a location failure to the original 
requesting entity and re-enters IDLE state. 

8.4 Signalling connection for the lu interface 

When using the lu interface, before SGSN/MSC server can request location information of a target UE from RAN, an 
lu signalling connection must have been established between SGSN/MSC server and RAN. The SGSN/MSC server 
sends a location request message to RAN, which determines the location of the target UE related to this lu signalling 
connection and sends a location report to SGSN/MSC server over the same lu signalling connection. On the lu 
interface, only one location request for a geographic location estimate can be ongoing at any time. 

8.5 Signalling connection for the A-interface 

When using the A interface, before MSC can request location information of a target UE from RAN, an A interface 
signalling connection must have been established between MSC and RAN. The MSC sends a location request message 
to RAN, which determines the location of the target UE related to this A interface signalling connection and sends a 
location report to MSC over the same A interface signalling connection. On the A interface, only one location request 
can be ongoing at any time. 

8.6 Gb interface mapping of target UE 

The pre-requisite for LCS procedures on the Gb interface is that UE is in "ready state". On the Gb interface, only one 
location request can be ongoing at any time. 

8.7 LCS State description for IVIIVIE 
8.7.1 IVIIVIE States 

An MME supports at least one location session for any UE at any one time. A location session is invoked by the MME 
in order to obtain the location of the UE or perform some other location related service such as transferring assistance 
data to the UE. 

8.7.1.1 LCS IDLE State 

In this state, the MME location service is inactive for a particular UE. The UE is known in the MME and a mobility 
management connection for the UE may or may not be active. 

8.7.1.2 LOCATION State 

In this state, the MME is awaiting a response from an E-SMLC after requesting a location service for a particular UE. In 
this state, the UE is known in the MME and a Mobility Management connection to the UE is active. 
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8.7.2 State Functionality 
8.7.2.1 State Transitions 
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Figure 8.4: State Transitions in thie IVIIVIE 

Moving from LCS-IDLE to LOCATION state: 

After a request has been received for a particular location service for a particular UE and the UE subscription options 
have been verified where applicable to allow this, the MME sends a location request to an E-SMLC. The MME then 
enters the LOCATION state. Before entering this state, the MME must have setup a Mobility Management connection 
to the UE if none was previously active. 

Moving from LOCATION to LCS IDLE state: 

After the return of a location result from the E-SMLC, or if the Location Timer described below expires, the MME shall 
re-enter IDLE state. 



8.7.2.2 



LOCATION Timer Function 



The MME runs a timer while in the LOCATION state, whose value may depend on the location service, to limit the 
amount of time waiting for a location response from the E-SMLC. If the timer expires before such information is 
received, the MME indicates a location failure to the original requesting entity and re-enters IDLE state. 

8.8 Signalling connection for the S1 interface 

Before the MME can request location information of a target UE from the E-SMLC, an S 1 signalling connection must 
have been established between the MME and E-UTRAN. The MME sends a location request message to E-SMLC, 
which determines the location of the target UE related to this S 1 signalling connection and sends a location 
measurement report to the MME. 



9 General Network Positioning Procedures 

The generic network positioning procedure of providing the location information of an UE subscriber can be partitioned 
into the following procedures. 

Location Preparation Procedure 
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This generic procedure is concerned with verifying the privacy restrictions of the UE subscriber, reserving network 
resources, communicating with the UE to be located and determining the positioning method to be used for locating the 
UE subscriber based on the requested QoS and the UE and network capabilities. 

Positioning Measurement Establishment Procedure 

This procedure is concerned with performing measurements by involving the necessary network and/or UE resources. 
Depending on the positioning method to be used for locating the UE the internals of this procedure can be positioning 
method dependent. The procedure is completed with the end of the positioning measurements. 

Location Calculation and Release Procedure 

This generic procedure is initiated after the measurements are completed and is concerned with calculating the location 
and optionally, velocity of the UE and releasing all network and/or UE resources involved in the positioning. 

Each of the following procedures defines the support of a single location request (MT-LR, MO-LR or NI-LR) that may 
be immediate or deferred. Treatment alternatives for a new location request when other concurrent locations requests 
are already ongoing for the same target UE is not generally defined in these procedures except in certain specific cases. 
For such general treatment alternatives, refer to clause 4.5. 

9.1 Mobile Terminating Location Request 

The MT-LR procedures for the location request from the LCS client which does not have the privacy override 
capability are described in the chapter 9.1.1. 

The MT-LR procedures for the location request from the LCS client which has the privacy override capability (e.g. the 
request is come from the emergency service provider) are described in the chapter 9. 1.1 A. In this case the H-GMLC is 
not involved to the location procedures and the privacy check procedures in H-GMLC/PPR are skipped. 

It is noted that R-GMLC or the UE may handle the periodicity of location requests as requested by the LCS client both 
in CS and PS domain. 
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9.1 .1 Common MT-LR procedure in PS and CS domain 
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Figure 9.1 : General Network Positioning for a MT-LR 

1) An external LCS client requests the current location and optionally, velocity of a target UE from a GMLC. The 
LCS Client may also request a deferred location request, i.e. based on event. The R-GMLC verifies the identity 
of the LCS client and its subscription to the LCS service requested and derives the MSISDN or IMSI or 
pseudonym of the target UE to be located and the LCS QoS from either subscription data or data supplied by the 
LCS client. For a call related location request, the LCS client includes the LCS client's called party number, as 
dialled by the target mobile user, in the LCS service request. For a session related location request, the LCS 
client includes the APN-NI of the LCS client, as used by the target UE, in the LCS service request. For a 
call/session related request the R-GMLC may verify that the called party number or APN-NI is correct for the 
LCS client in question. The LCS client's dialled number or APN-NI are checked in step 9 for the call/session 
related class. 

The LCS request may carry also the Service Identity and the Codeword and the service coverage information. 
The R-GMLC may verify that the Service Identity received in the LCS request matches one of the service 
identities allowed for the LCS client. If the service identity does not match one of the service identities for the 
LCS client, the R-GMLC shall reject the LCS request. Otherwise, the R-GMLC can map the received service 
identity in a corresponding service type. 

If the location request is originated by a Requestor, the Requestor Identity may be added to the LCS service 
request. The LCS client should authenticate the Requestor Identity but this is outside the scope of this 
specification. The LCS service request may also contain the type of the Requestor identity if the requestor 
identity was included. 
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If the H-GMLC address is not contained in the pseudonym or cannot deduced from the pseudonym, the R- 
GMLC shall determine the verinym for the pseudonym. In this case the R-GMLC may access to its associated 
PMD as described in 9.1.1.3. 

The R-GMLC verifies whether it stores the privacy profile of the target UE. If the R-GMLC stores the UE's 
privacy profile, (this means the R-GMLC is the H-GMLC of the target UE), then step 2, 3, 4 and 12 are skipped. 
If location is required for more than one UE, the steps following below may be repeated and in that case the R- 
GMLC should verify whether the number of Target UEs in the LCS request is equal or less than the Maximum 
Target UE Number of the LCS client. If the Maximum Target UE Number is exceeded, the R-GMLC should 
respond to the client with proper error cause. If periodic location is requested, the steps following below may be 
repeated or the R-GMLC may forward the periodic location request to the UE, see clause 9.1.12. 

2) If the R-GMLC already knows, (e.g. from a previous location request or an internal lookup table), or is able to 
determine, (e.g. it is possible to use a DNS lookup mechanism similar to IETF RFC 2916), the network address 
of H-GMLC of the target UE, or in case the location service request contains the target UE's pseudonym, which 
includes the target UE's Home-GMLC address, or a pseudonym from which the target UE's Home-GMLC 
address can be deduced, then this step and step 3 may be skipped. 

Otherwise, the R-GMLC sends a SEND_ROUTING_INFO_FOR_LCS message to the home HLR/HSS of the 
target UE to be located with the IMSI or MSISDN of the UE. 

The details of the alternative methods of retrieving H-GMLC address other than the sending 
SEND_ROUTING_INFO_FOR_LCS message to the HLR/HSS, (e.g. internal lookup table, DNS lookup 
mechanism), are not in the scope of this specification. 

Editor's note: The support for number portability with these alternative solutions of retrieving H-GMLC address still 
needs further study and should be in line with the general solution to support number portability in Rel-6. 

3) The HLR/HSS verifies whether the R-GMLC is authorized to request UE location information. If not, an error 
response is returned. 

Otherwise the HLR/HSS returns one or several of the network addresses of the current SGSN and/or 
VMSC/MSC server and/or current MME, the LCS capabilities of the serving nodes if available , the V-GMLC 
address associated with the serving nodes, if available and whichever of the IMSI and MSISDN that was not 
provided in step 2. The HLR/HSS returns the address of the H-GMLC. The HLR/HSS also returns the address of 
the PPR, if available. 

NOTE 1: HLR/HSS may prioritise between the MSC/VLR or SGSN or MME address sent to the GMLC. The 
prioritisation might be based on information received from SGSN and/or MSC/VLR and/or MME 
concerning the UE's capabilities for LCS. Other priority criteria are for further study. 

4) If R-GMLC finds out that it is the H-GMLC, the signalling steps 4 and 15 ai-e skipped. 

If the R-GMLC did not receive the H-GMLC address in step 3 and can not retrieve the H-GMLC address in 
some other way (e.g. DNS lookup), then steps 4, 5, 6, 7, 8, 10, 11, 12, 14 and 15 are skipped and the R-GMLC 
directly sends the PSL message to the serving node. 

Otherwise, the R-GMLC sends the location request to the H-GMLC. If one or several of the network addresses 
of the current SGSN and/or VMSC/MSC server and/or current MME, the LCS core network signalling 
capabilities of the serving nodes, IMSI and MSISDN for the target UE and the address of the V-GMLC and the 
PPR have been retrieved in Step 3, the R-GMLC shall pass the information with the location request to the H- 
GMLC. The R-GMLC shall also send the service coverage information to the H-GMLC, if the information is 
available. 

5) The H-GMLC verifies whether the R-GMLC is authorized to request UE location information. If the R-GMLC is 
not authorized, an error response is returned. 

If the LCS service request contains the pseudonym of the target UE and the H-GMLC cannot resolve the PMD 
address from the pseudonym, the H-GMLC itself determines the verinym (MSISDN or IMSI) of the target UE. If 
the H-GMLC can resolve the address of PMD from the pseudonym, the H-GMLC requests the verinym from its 
associated PMD, see clause 9.1.1.3. In case H-GMLC knows that the PMD functionality is integrated in PPR, it 
can include the information from the LCS Identity Request in the LCS authorisation request to the PPR, see 
clause 9.1.1.1. In this case, if H-GMLC is not able to obtain the verinym of the target UE, the H-GMLC shall 
cancel the location request. 

The H-GMLC performs privacy check on the basis of the UE user's privacy profile stored in the H-GMLC and 
the capabilities of the serving nodes (MSC/VLR and/or SGSN and/or MME), if available. If the privacy profile 
of the target UE is stored in a PPR and the H-GMLC received the network address of the PPR from R-GMLC or 
is able to determine the PPR address (e.g. from a previous location request or an internal lookup table), the H- 
GMLC shall ask the PPR to perform the privacy check as described in the 9.1.1.1. If the privacy profile is stored 
in a PPR but the network address of the PPR is not available, the H-GMLC shall send SRI for LCS message to 



ETSI 



3GPP TS 23.271 version 11.1.0 Release 1 1 57 ETSI TS 1 23 271 V1 1 .1 .0 (201 3-01 ) 

HLR/HSS in step 6 in order to get the PPR address and the privacy check in this step shall be performed after 
step 7. Also if the key of the UE user's privacy profile (i.e. MSISDN or IMSI) is not available, the privacy check 
in this step shall be performed after step 7. The H-GMLC/PPR verifies LCS barring restrictions in the UE user's 
privacy profile in the H-GMLC/PPR. In verifying the barring restrictions, barring of the whole location request 
is assumed if any part of it is barred or any requisite condition is not satisfied. If the location service request is to 
be barred, GMLC shall terminate the request towards the R-GMLC or the LCS client with the appropriate error 
code. As a result of the privacy check, the H-GMLC/PPR selects one or two indicators of the privacy check 
related action and/or a pseudo-external identity in the case of interaction with a pre Rel-6 serving node. (The 
details of the indicator of the privacy check related action and the pseudo-external identity are described in 
chapter 9.5.4 and Annex C). If the requested type of location is "current or last known location" and the 
requested maximum age of location information is available, the H-GMLC verifies whether it stores the 
previously obtained location estimate of the target UE. If the H-GMLC stores the location estimate and the 
location estimate satisfies the requested accuracy and the requested maximum age of location, the H-GMLC 
checks the result of the privacy check. In case the result of the privacy check for call/session unrelated class is 
"Location allowed without notification" then steps 6, 7, 8, 9 and 10 may be skipped. 

6) If the H-GMLC does not know IMSI for the particular MSISDN (e.g. from a previous location request), and the 
VMSC/MSC server address, SGSN address or MME address, the H-GMLC shall send a 
SEND_ROUTING_INFO_FOR_LCS message to the home HLR/HSS of the target UE to be located with the 
IMSI or MSISDN of this UE. Also if the privacy profile is stored in a PPR but the network address of the PPR 
was not available in the step 5, the H-GMLC shall send the SRI for LCS message to HLR/HSS. Otherwise, this 
step and step 7 may be skipped. 

7) The HLR/HSS then returns one or several of the network addresses of the current SGSN and/or VMSC/MSC 
server and/or current MME, the LCS core network signalling capabilities of the serving nodes , the V-GMLC 
address associated with the serving nodes, if available and whichever of the IMSI and MSISDN that was not 
provided in step (6) for the particular UE. The HLR/HSS may also return the address of the PPR, if available. 

NOTE 2: HLR/HSS may prioritise between the MSC/VLR or SGSN or MME address sent to the GMLC. The 
prioritisation might be based on information received from SGSN and/or MSC/VLR and/or MME 
concerning the UE's capabilities for LCS. Other priority criteria are for further study. 

NOTE 3: If ISR is active for LTE access, the HSS may return the address of both the current MME and current 
SGSN. 

8) If step 6 and step 7 were performed, the H-GMLC/PPR may do a new privacy check, or if the privacy profile is 
stored in a PPR but the network address of the PPR was not available in step 5 and the PPR address is obtained 
in step 7, the H-GMLC shall ask the PPR to perform the privacy check as described in the 9.1.1.1. 

The H-GMLC shall forward a request for a deferred MT-LR only to an SGSN and/or VMSC/MSC server. If 
neither was indicated by the HLR/HSS in step 7 in the case of a deferred MT-LR (e.g. if the HLR/HSS returned 
the current MME but not a current SGSN or VMSVC/MSC sever), the H-GMLC shall return an error to the 
R-GMLC. 

Also if the location request is an immediate location request and the service coverage information was sent from 
R-GMLC, the H-GMLC checks the country codes of the serving node addresses. If the H-GMLC finds out the 
current SGSN and/or VMSC/MSC server and/or current MME locates out of the service coverage, the H-GMLC 
returns an appropriate error message to the R-GMLC or the LCS client. 

In the cases when the H-GMLC did not receive the address of the V-GMLC, or when the V-GMLC address is 
the same as the H-GMLC address, or when both PLMN operators agree not to use the Lr interface, the H-GMLC 
does not send the location request to the V-GMLC and step 10 is skipped. In this case, the H-GMLC sends the 
location service request message to the serving node. 

If the H-GMLC received the address of the V-GMLC from the HLR/HSS and the V-GMLC address is different 
from the H-GMLC address, the H-GMLC may send the location request to the V-GMLC. The location request 
shall contain one or several of the network addresses of the current SGSN and/or MSC/VLR and/or current 
MME, and the IMSI and MSISDN of the target UE. The location request may also carry the requested action of 
the VPLMN as the result of the privacy check in the H-GMLC (i.e. by using the indicator of the privacy check 
related action as described in chapter 9.5.4 or by using the pseudo-external identity as described in Annex C in 
the case of query to a pre Rel-6 serving node). If the result of privacy check indicates that the notification (and 
verification) based on current location is needed, the H-GMLC shall send a location request to the V-GMLC 
indicating "positioning allowed without notification" or, for backwards compatibility with a pre Rel-6 serving 
node, a pseudo external identity representing the same privacy notification and verification action required as for 
the "positioning allowed without notification" procedure as described in Annex C and V-GMLC shall send a 
Provide Subscriber Location message to the MSC/SGSN/MME indicating "positioning allowed without 
notification" or, for backwards compatibility with a pre Rel-6 serving node, a pseudo external identity 
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representing the same privacy notification and verification action required as for the "positioning allowed 
without notification" procedure as described in Annex C. The V-GMLC first authenticates that the location 
request is allowed from this GMLC, PLMN or from this country. If not, an error response is returned. 

Editor's Note; The restriction for a deferred MT-LR in the case of a current MME may be removed in a later version 
of this TS. 

9) If the GMLC (H-GMLC, R-GMLC or V-GMLC) receives only the MSC/VLR address, the MT LR proceeds as 
the CS-MT-LR procedure described in clause 9.L2.If the GMLC receives only the SGSN address, the MT LR 
proceeds as the PS-MT-LR procedure described in clause 9.L6. If the GMLC receives only the MME address, 
the MT LR proceeds as the EPC -MT-LR procedure described in clause 9.L15. If the GMLC receives several of 
the following addresses, SGSN, VMSC, MSC Server and/or MME, it has to decide where to send the location 
request. If the requested MT-LR is known to be associated with a CS call, the CS-MT-LR procedure shall be 
invoked. If the requested MT-LR is associated with a PS session in UTRAN, the PS-MT-LR procedure shall be 
invoked. If the requested MT-LR is associated with a PS session in E-UTRAN, the EPC-MT-LR procedure shall 
be invoked. Otherwise, two or more of CS-MT-LR, PS-MT-LR and EPC-MT-LR are applicable. If LCS Client 
indicated deferred location request, GMLC shall indicate this together with applicable event type (e.g. UE 
available) in the requested PS/CS-MT-LR, see 9.L8. 

NOTE 4: The order in which these procedures are invoked and whether one or both procedures are used may 

depend on information in the LCS service request, subscription information for the LCS client, possible 
priority information returned by the HSS or information akeady stored in the GMLC (e.g. obtained from 
previous location requests). The order may also depend on operator preference for invoking or not 
invoking location estimation on a particular access type when CSFB or ISR may be supported. 

NOTE 5: If ISR is active for LTE access, the V-GMLC receives both an SGSN and MME address. The VGMLC 
may then instigate both PS-MT-LR and EPC-MT-LR procedures. This will lead to separate paging of the 
UE in its registered TA(s) in association with the MME procedure and in its registered RA(s) in 
association with the SGSN procedure. The UE would then respond to only one paging request leading to 
continuation of only one of the MT-LR procedures and a termination of the other. The V-GMLC will 
discover which is which from the responses it later receives from the MME and SGSN for each MT-LR 
procedure. 

10) The V-GMLC sends the location service response to the H-GMLC in accordance with the requested LCS QoS 
Class. If the requested LCS QoS class was Assured, V-GMLC sends the result only if the result has been 
indicated to fulfil the requested accuracy, otherwise V-GMLC sends a LCS service response with a suitable error 
cause. If the UE requested LCS QoS class was Best Effort, V-GMLC sends whatever result it received with an 
appropriate indication if the requested accuracy was not met. The location service response may contain the 
information about the positioning method used. The V-GMLC may record charging information. 

1 1) If the privacy check in step 5 indicates that further privacy checks are needed, or on the basis of the privacy 
profile, the H-GMLC shall perform an additional privacy check or the H-GMLC may ask the PPR to perform the 
privacy check as described in the 9.LL1 in order to decide whether the H-GMLC can forward the location 
information to the LCS client or send a notification if the result of the privacy check requires the notification and 
verification based on current location. If the location request from the R-GMLC or the LCS client contained the 
pseudonym, the H-GMLC shall use the pseudonym of the target UE in the location response to the R-GMLC or 
the LCS client. One example when this additional privacy check is needed is when the target UE user has 
defined different privacy settings for different geographical locations. 

12)If the result of privacy checks in step 11 indicates that the notification (and verification) based on current 
location is needed, the HGMLC shall send a location request to the V-GMLC indicating "notification only" or, 
for backwards compatibility with a pre Rel-6 serving node, a pseudo external identity representing the same 
privacy notification and verification action required as for the "notification only" procedure as described in 
Annex C. Otherwise this step and steps 13, 14 may be skipped. If the H-GMLC received the address of the V- 
GMLC from the HLR/HSS and the V-GMLC address is different from the H-GMLC address in step 8, the H- 
GMLC may send the location request to the V-GMLC. The location request shall contain one or several of the 
network addresses of the cuiTent SGSN and/or MSC/VLR and/or current MME, and the IMSI and MSISDN of 
the target UE. 

NOTE: The use of pseudo external identities in this step implies that a second positioning attempt is performed. 

13) If the GMLC (H-GMLC, R-GMLC or V-GMLC) received only the MSC/VLR address in step 9, the MT LR 
proceeds as the CS post positioning notification and verification procedure described in clause 9.1.10 or 
clause 9.1.2 if pseudo external identity is used. If the GMLC receives only the SGSN address in step 9, the MT 



ETSI 



3GPP TS 23.271 version 1 1 .1 .0 Release 1 1 59 ETSI TS 1 23 271 V1 1 .1 .0 (201 3-01 ) 

LR proceeds as the PS post positioning notification and verification procedure described in clause 9.1.11 or 
clause 9.1.6 if pseudo external identity is used. If the GMLC receives only the MME address in step 9, the MT 
LR proceeds as the EPC post positioning notification and verification procedure described in clause 9.1.18. If the 
GMLC receives several of the following addresses, SGSN, VMSC, MSC Server and/or MME, it has to decide 
where to send the location request. If the requested MT-LR is known to be associated with a CS call, the CS post 
positioning notification and verification procedure shall be invoked. If the requested MT-LR is associated with a 
PS session in UTRAN, the PS post positioning notification and verification procedure shall be invoked. If the 
requested MT-LR is associated with a PS session in E-UTRAN, the EPC post positioning notification and 
verification procedure shall be invoked. Otherwise, CS and/or PS and/or EPC post positioning notification and 
verification procedure are applicable. 

14) The V-GMLC sends the location service response with an indication of the result of notification and verification 
procedure performed in step 13 to the H-GMLC. 

15)The H-GMLC sends the location service response to the R-GMLC. The H-GMLC may store the location 

information and its age. The location service response may contain the information about the positioning method 
used and the indication whether the obtained location estimate satisfies the requested accuracy or not. The H- 
GMLC may record charging information. 

16) R-GMLC sends the location service response to the LCS client. If the location request from the LCS client 
contained the pseudonym and the R-GMLC resolved the verinym from the pseudonym in the step 1, the R- 
GMLC shall use the pseudonym of the target UE in the location response to the LCS client. If the LCS client 
requires it, the R-GMLC may first transform the universal location co-ordinates provided by the SGSN or 
MSC/MSC server or MME into some local geographic system. The R-GMLC may record charging information 
both for the LCS client and inter-network revenue charges from the SGSN or MSC/MSC server or MME's 
network. The location service response from the R-GMLC to the LCS client may contain the information about 
the positioning method used and the indication whether the obtained location estimate satisfies the requested 
accuracy or not. 

The detailed CS-MT-LR, PS-MT-LR and EPC-MT-LR procedures in step 9 of figure 9.1 are described in clauses 9.1.2, 
9.1.6 and 9.1.15. The detailed procedure for deferred PS/CS-MT-LR is described in clause 9.1.8. 

9.1 .1 A Common MT-LR procedure in PS and CS domain for Emergency 
MT-LR 

This clause describes how an emergency location request may be handled similarly to a normal location request. This 
method should be restricted to those countries where there is not a national requirement to provide location for callers 
who are either roaming or making a SIM-less emergency call, or making a non-registered (U)SIM emergency call. It is 
also appropriate to use this method to provide location for lawful intercept services where allowed by national 
regulation. 
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Figure 9.1 A: Network Positioning for an Emergency lUIT-LR 

1) An external LCS client which has the privacy override capability, (e.g. Emergency service provider), requests 
the location of a target UE from a GMLC. The R-GMLC verifies the identity of the LCS client and its 
subscription to the LCS service requested and derives the MSISDN or IMSI of the target UE to be located and 
the LCS QoS from either subscription data or data supplied by the LCS client. 

2) If the R-GMLC already knows IMSI for the particular MSISDN, (e.g. from a previous location request) and the 
VMSC/MSC server address, SGSN address or MME address, this step and step 3 may be skipped. Otherwise, 
the R-GMLC sends a SEND_ROUTING_INFO_FOR_LCS message to the home HLR/HSS of the target UE to 
be located with the IMSI or MSISDN of this UE. 

3) The HLR/HSS verifies whether the R-GMLC is authorized to request UE location information. If not, an error 
response is returned. 

Otherwise the HLR/HSS returns one or several of the network addresses of the current SGSN and/or 
VMSC/MSC server and/or current MME and whichever of the IMSI and MSISDN that was not provided in step 
2. The HLR/HSS also returns the address of the V-GMLC associated with the serving nodes, if available. 

NOTE 1: HLR/HSS may prioritise between the MSC/VLR, SGSN or MME address sent to the GMLC. The 
prioritisation might be based on information received from SGSN and/or MSC/VLR and/or MME 
concerning the UE's capabilities for LCS. Other priority criteria are for further study. 

NOTE 2: If ISR is active for LTE access, the HSS may return the address of both the current MME and current 
SGSN. 

4) In the cases when the R-GMLC did not receive the address of the V-GMLC, or when the V-GMLC address is 
the same as the R-GMLC address, or when both PLMN operators agree not to use the Lr interface, the R-GMLC 
does not send the location request to the V-GMLC and the step 6 is skipped. In this case, the R-GMLC sends the 
location service request message directly to the serving node. 

If the R-GMLC received the address of the V-GMLC from the HLR/HSS and the V-GMLC address is different 
from the R-GMLC address, the R-GMLC sends the location request to the V-GMLC. The location request shall 
contain one or several of the network addresses of the current SGSN and/or MSC/VLR, the IMSI and MSISDN 
of the target UE and the privacy override indicator. The V-GMLC first authenticates that the location request is 
allowed from this GMLC, PLMN or from this country. If not, the positioning request is rejected and an error 
response is returned. Otherwise, it sets the privacy indicator to "not allowed" and includes it with the POI in the 
Provide Subscriber Location message. 

5) If the GMLC receives only the MSC/VLR address, the MT LR proceeds as the CS -MT-LR procedure described 
in clause 9.L2. If the GMLC receives only the SGSN address, the MT LR proceeds as the PS-MT-LR procedure 
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described in clause 9.1.6. If the GMLC receives only the MME address, the MT LR proceeds as the EPC-MT- 
LR procedure described in clause 9.1.15. If the GMLC receives several of the following addresses, SGSN, 
VMSC, MSC Server and/or MME, it has to decide where to send the location request. In any case the serving 
node checks for POI applicability. 

NOTE: The order in which these procedures are invoked and whether one or both procedures are used may 

depend on information in the LCS service request, subscription information for the LCS client, possible 
priority information returned by the HLR/HSS or information already stored in the GMLC (e.g. obtained 
from previous location requests). 

6) The V-GMLC sends the location service response to the R-GMLC. The location service response may contain 
the information about the positioning method used. The V-GMLC may record charging information. 

7) R-GMLC sends the location service response to the LCS client. If the LCS client requires it, the R-GMLC may 
first transform the universal location co-ordinates provided by the SGSN or MSC/MSC server into some local 
geographic system. The location service response from the GMLC to the LCS client may contain the information 
about the positioning method used. After receiving (stage 3) acknowledgement from the LCS client, the R- 
GMLC may record charging information both for the LCS client and inter-network revenue charges from the 
SGSN or MSC/MSC server's network. 

The detailed CS-MT-LR, PS-MT-LR and EPC-MT-LR procedures in step 5 of figure 9.1 A are described in 
clauses 9.1.2, 9.1.6 and 9.1.15. 



9.1.1.1 



LCS Authorisation request 



If the UE subscribers LCS privacy information is kept in the PPR the GMLC (H-GMLC) shall send a LCS 
Authorisation request to PPR, see figure 9. IB. 



GMLC 



PPR 



1. LCS Authorisation Request 



2. LCS Authorisation Response 



Figure 9.1 B: LCS authorisation in PPR 

1) The GMLC sends the LCS authorisation request to the PPR. The LCS authorisation request carries the type of 
location information requested (e.g. current location), the LCS client type, the UE subscriber's identity and 
indication whether the request is call/session related or call/session unrelated. The UE subscriber's identity can 
be one or both of MSISDN and IMSI. If PMD functionality is integrated in PPR, the LCS authorization request 
may carry the pseudonym of the target UE, instead of the verinym. In case GMLC received the LCS client's 
called party number or the APN-NI of the target mobile's session, GMLC shall request both call/session related 
and call/session unrelated privacy checks in PPR. In case GMLC did not receive the LCS client's called party 
number or the APN-NI of the target mobile's session, GMLC requests only a call/session unrelated privacy 
check in PPR. For a value added LCS client, the message shall carry the client's name, the external identity of 
the LCS client and the requestor identity (if that is both supported and available). Moreover the message may 
also carry the Service Type and the Codeword. This message shall also carry the LCS capabilities of the SGSN 
or VMSC/MSC server. 
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In case the additional privacy check was requested to be performed after the positioning procedure the LCS 
Authorisation Request shall also include the location estimate. 

2) If the LCS authorization request contains the pseudonym of the target UE, the PPR with PMD functionality 
seeks to determine the verinym of the target UE. PPR performs the privacy check based on the target UE's 
privacy profile. The result of that privacy check is sent to GMLC in the LCS Authorisation response. If the 
location request is to be barred, the PPR shall send an indication of this within the LCS Authorisation response 
and no other indicators. If requested by the GMLC the PPR shall include two privacy check results for the LCS 
Authorisation response, both call/session related and call/session unrelated privacy check results. The response 
may also contain information if an additional privacy check is needed when the GMLC has received the location 
information of the target UE (e.g. if the target UE allows its location information to be given to the LCS client 
only when it is located in certain areas). 

If the LCS authorisation request contains the pseudonym of the target UE and the PPR has integrated PMD 
functionality, the PPR shall return the target UE's IMSI and/or MSISDN corresponding to the pseudonym in the 
LCS authorisation response. 

If PPR received information that the visited MSC/SGSN is pre Rel-6 it shall select a pseudo external ID which 
shall carry the response of the privacy check. For more information on pseudo external Ids, see Annex C. 



9.1.1.2 



LCS Privacy Profile Update 



If the UE subscribers privacy information has been changed in the PPR the LCS Privacy Profile Update shall be send to 
the GMLC (H-GMLC), see figure 9.1C. 
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2. LCS profile update notification ack 



Figure 9.1 C: PPR notification to GIVILC about LCS privacy profile change 

1) In case subscriber changed his privacy profile information in the PPR the LCS Privacy Profile Update shall be 
send to the GMLC (H-GMLC). The message shall carry the identity of the UE subscriber. 

2) GMLC acknowledges that it received the notification 

9.1 .1 .3 LCS identity request 

The GMLC may request the verinym of the UE from the PMD, see figure 9. ID. 



GMLC 



PMD 



1. Identity Request 



2. Identity Response 



Figure 9.1 D: LCS identity request 

1) The GMLC sends the pseudonym to its associated PMD and requests the corresponding verinym of the target 
UE from PMD. 
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2) The PMD shall map or decrypt (e.g. using the private key of the operator) the target UE's pseudonym to the 
corresponding verinym, i.e. IMSI and /or MSISDN, to be included in the Identity Response. 

9.1 .2 Circuit Switclned Mobile Terminating Location Request (CS-MT-LR) 

Figure 9.2 illustrates general network positioning for LCS clients external to the PLMN. In this scenario, it is assumed 
that the target UE is identified using either an MSISDN or IMSI. 
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Figure 9.2: Network Positioning for a CS-IUIT-LR 
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9.1.2.1 Location Preparation Procedure 

1) Common PS and CS MT-LR procedure as described in 9.1.1. 

2) The GMLC sends a PROVIDE. SUBSCRIBER .LOCATION message to the MSC/MSC server indicated by 
the HLR/HSS. This message carries the type of location information requested (e.g. current location and 
optionally, velocity), the UE subscriber's IMSI, LCS QoS information (e.g. accuracy, response time) and an 
indication of whether the LCS client has the override capability. For a call related location request, the message 
also carries the LCS client's called party number. For a value added LCS client, the message shall carry the client 
name, the external identity of the LCS client (or the pseudo external identity) and the Requestor Identity (if that 
is both supported and available). Also the message may carry the type of the LCS client name and also the type 
of the Requestor identity if the requestor identity was included. For a PLMN operator LCS client, the message 
shall carry the internal identity of the LCS client. Moreover the message may also carry the Service Type. If the 
result of the privacy check at H-GMLC/PPR indicated that the codeword shall be sent to the UE user, the 
message may carry also the codeword received from the LCS client. For a PLMN operator LCS client, the 
message shall carry the internal identity of the LCS client. If the Requestor Identity is provided, the GMLC shall 
send it as separate information. In addition, in order to display the requestor identity in case of pre rel-5 network 
elements (i.e. MSC and/or UE), the requestor identity may be also added to the LCS client name by the GMLC. 
When the Requestor identity is added to the LCS client name the practise described in the Annex D should be 
followed. The message also shall carry the indicators of privacy related action which is described in chapter 
9.5.4 , if it is provided by H-GMLC. 

3) If the GMLC is located in another PLMN or another country, the VMSC/MSC server first authenticates that a 
location request is allowed from this PLMN or from this country. If not, an error response is returned. If the PSL 
message from the GMLC contains the indicators of privacy related action, the VMSC/MSC server determines a 
required privacy related action as described in Annex A.3. If the PSL message from the GMLC does not include 
the indicators of privacy related action, the VMSC/MSC server then verifies LCS barring restrictions in the UE 
user's subscription profile in the MSC server. In verifying the barring restrictions, barring of the whole location 
request is assumed if any part of it is barred or any requisite condition is not satisfied. If LCS is to be barred 
without notifying the target UE and a LCS client accessing a GMLC in the same country does not have the 
override capability, an error response is returned to the GMLC. 

Otherwise, if the UE is in idle mode, the Core Network performs paging, authentication and ciphering. The MSC 
will page a GPRS attached UE either through A/Iu or Gs interface, depending on the presence of the Gs interface 
(see Note 2). The UE will inform the network about its LCS capabilities, as described in chapter 6.3.4. If the UE 
is instead in dedicated mode, the VMSC/MSC server will already have UE classmark information. In GSM this 
is supported by controlled early classmark sending. 

NOTE 1 : In GSM, if the target UE has an established circuit call other than speech, the location request may be 
denied and an error response is then returned to the GMLC. If the location request is allowed for a non- 
speech circuit call, it shall be up to RAN to decide, on the basis of the applicable position methods and 
requested QoS, whether positioning is possible. 

NOTE 2: In some network mode of operation, a GPRS capable UE may not receive the CS paging. In addition, 
upon receipt of a CS paging, a GPRS capable UE may immediately answer to the Paging Request or 
delay the answer, as defined in TS 22.060 [35b] and TS 23.060 [15]. A GPRS UE in class B mode may 
also suspend its GPRS traffic, sending a GPRS Suspension Request to the network. 

4) If the location request comes from a value added LCS client and the indication of requested privacy related 
action or the UE subscription profile indicates that the UE must either be notified or notified with privacy 
verification and the UE supports notification of LCS (according to the UE Capability information), an LCS 
Location Notification Invoke message is sent to the target UE indicating the type of location request from the 
LCS Client (e.g. current location or "current or last known location") and the identity of the LCS client, the 
Requestor Identity (if that is both supported and available) and whether privacy verification is required. Also the 
message may indicate the type of the LCS client name and also the type of the Requestor identity if the requestor 
identity was included. Moreover, the message may carry also the service type and the codeword. 

Optionally, the VMSC/MSC server may, after sending the LCS Location Notification Invoke message continue 
in parallel the location process, i.e. continue to step 6 without waiting for a LCS Location Notification Return 
Result message in step 5. 

NOTE 3: It is for further study, if all available client identities are to be included in the Privacy Notification 
message to be shown to the end-user. 
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5) The target UE notifies the UE user of the location request. If privacy verification was requested, the target UE 
indicates to the UE user whether the location request will be allowed or not allowed in the absence of a response 
and waits for the user to grant or withhold permission. The UE then returns an LCS Location Notification Return 
Result to the VMSC/MSC server indicating, if privacy verification was requested, whether permission is granted 
or denied. Optionally, the LCS Location Notification Return Result message can be returned some time after 
step 4, but before step 9. If the UE user does not respond after a predetermined time period, the VMSC/MSC 
server shall infer a "no response" condition. The VMSC/MSC server shall return an error response to the GMLC 
if privacy verification was requested and either the UE user denies permission or there is no response with the 
UE subscription profile indicating barring of the location request in the absence of a response. 

6) The MSC/MSC server sends a Location Request message to RAN. This message includes the type of location 
information requested and requested QoS and, in GSM, the UE's location capabilities. 

9.1 .2.2 Positioning IVIeasurement Establishment Procedure 

7) RAN determines the positioning method and instigates the particular message sequence for this method, as 
specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

9.1 .2.3 Location Calculation and Release Procedure 

8) When a location estimate best satisfying the requested QoS has been obtained, RAN returns it to the MSC/MSC 
server in a Location Report message. RAN shall in its response include an indication whether the obtained 
location estimate satisfies the requested accuracy or not. The information about the positioning method used may 
be returned with the location estimate. If a location estimate could not be obtained, RAN returns a Location 
Report message containing a failure cause and no location estimate. 

9) The MSC/MSC server returns the location information, its age and obtained accuracy indication to the GMLC, if 
the VMSC/MSC server has not initiated the Privacy Verification process in step 4. If step 4 has been performed 
for privacy verification, the VMSC/MSC server returns the location information only, if it has received a LCS 
Location Notification Return Result indicating that permission is granted. In these cases, the information about 
the positioning method used may be sent with the location information. If a LCS Location Notification Return 
Result message indicating that permission is not granted is received, or there is no response, with the requested 
privacy action or the UE subscription profile indicating barring of location in the absence of a response, the 
VMSC/MSC server shall return an error response to the GMLC. If RAN did not return a successful location 
estimate, but the privacy checks in steps 4-5 were successfully executed, the VMSC/MSC server may return the 
last known location of the target UE if this is known and the LCS client is requesting the current or last known 
location. The MSC/MSC server may then release the Mobility Management connection to the UE, if the UE was 
previously idle, and the MSC/MSC server may record charging information. 

10)Common MT-LR procedure in PS and CS domain as described in 9.LL 

9.1 .3 CS-MT-LR without HLR Query 

Figure 9.3 illustrates current or last known location requests for an emergency services call, where an emergency 
services client (i.e., a Public Safety Answering Point) identifies the target UE and the serving GMLC using correlation 
information that were previously provided to it by the VMSC. In North America, this correlation information is 
provided by either an NA-ESRK, or an MSISDN and NA-ESRD. In E.U. it is provided through the ISUP/BICC lAM 
message with location number parameter set to MSC number and the calling party number parameter set to MSISDN. 
The signalling used to provide the correlation information to the PSAP is out of scope of this TS, but is presumed to 
occur on the signalling for the call. This allows the requesting V-GMLC to request location from the VMSC without 
first querying the home HLR of the target UE. This scenario therefore supports location of emergency callers from 
roamers or SIM-less emergency calls, or non-registered (U)SIM emergency calls, and requires that the initial location, 
as well as UE and VMSC identifying information had been pushed to the GMLC as per 9.1.5 (or 9. 1.5. A for North 
America). In North America, additional requirements are found in [32]. 
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Figure 9.3: Positioning for a Emergency Services IVIT-LR without IHLR Query 

1) Same as step 1 in figure 9.1 but with the LCS cHent (PSAP) identifying first the target UE and the serving V- 
GMLC by previously supplied correlation information for the emergency call. 

2) The GMLC may determine the VMSC from correlation information received from the PSAP, or from stored 
information for the target UE (e.g. from a prior location estimate delivery from the VMSC/MSC server). In 
North America, the GMLC determines the VMSC using the NA-ESRK or NA-ESRD - with use of the NA- 
ESRK taking priority over that of the NA-ESRD. The MAP_PR0V1DE_SUBSCR1BER_L0CAT10N message 
sent to the VMSC carries the MSISDN and, if provided, the IMSl and IMEI for the target UE, as well as the 
required QoS and an indication of a location request from an emergency services client. The VMSC identifies 
the target UE using the IMSl or MSISDN and, if provided, the IMEl. In case of a SlM-less emergency call, or 
non-registered (U)SIM emergency call, the IMEl shall be always sent and the MSISDN may be populated with a 
non-dialable callback number as specified in clause 6.4.3. 

3) The MSC verifies that UE privacy is overridden by the emergency services provider and that positioning is not 
prevented for other reasons (e.g. unreachable UE, inapplicable call type to the UE). The VMSC then sends a 
Location Request to the RAN, as for a normal MT-LR. 

4) RAN performs positioning as for a normal CS-MT-LR. 

5) RAN returns a location estimate to the VMSC as for a normal CS-MT-LR. 

6) Same as step 9 for a normal CS-MT-LR. 

7) Same as step 10 for a normal CS-MT-LR. 

9.1 .4 CS-MT-LR and PS-MT-LR for a previously obtained location 
estimate 

Every time the location estimate of a target UE subscriber is returned by the RAN to the VMSC, MSC Server or SGSN, 
the corresponding entity may store the location estimate together with a time stamp. The MSC/MSC server may store 
this information in the subscriber's MSC server record. Also when the location estimate of a target UE subscriber is 
returned to the H-GMLC, the H-GMLC may store the location estimate together with the age in the subscriber's record. 

The time stamp is the time at which the location estimate is stored at the corresponding entity i.e. after the RAN returns 
the location estimate to the VMSC, MSC Server or SGSN. The time stamp indicates the "age" of the location estimate. 
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9.1.4.1 Initial Location 

In the context of an originating emergency call the location estimate and the associated time stamp at the 
commencement of the call set-up is referred to as "initial location". 

9.1.4.2 Current Location 

After a location attempt has successfully delivered a location estimate and its associated time stamp, the location 
estimate and time stamp is referred to as the "current location" at that point in time. 

9.1 .4.3 Last known Location 

Depending on national regulations, the current location estimate and its associated time stamp may be stored in 
MSC/VLR, MSC Server, SGSN, or in H-GMLC and until replaced by a later location estimate and a new time stamp is 
referred to as the "last known location". The last known location may be distinct from the initial location - i.e. more 
recent. 

9.1.4.4 Security and Privacy 

The collection and/or the release of the last known and initial location estimate of the target UE may not be allowed by 
national option. The handling of security and privacy of the target UE with regard to returning the last known or initial 
location estimate of the target UE shall be the same as when the target UE is reachable for positioning, (i.e. the 
requesting LCS client is authorized and the privacy of the target UE is secured before the VMSC/MSC server check the 
MSC server status of the target UE (i.e. whether the UE is marked as attached or detached in the MSC server). A similar 
status check apply for SGSN and MSC Server. 

9.1 .4.5 Failing to locate the target UE 

In case of a "Detached" or "Not Reachable" target UE, the last known location and a time stamp stored at the VLR, 
MSC Server or SGSN, may be returned to a LCS client requesting location information if the LCS client specifically 
requested the current or last known location. This does not apply to a value added LCS client where the target UE 
subscribes to notification of the location request: if the notification cannot be performed, the VMSC, MSC Server or 
SGSN shall reject the location request. 

NOTE: Due to CAMEL, the MSC/MSC serverA'^LR may already be storing other location information 

parameters like location number, service area identity and MSC server number in the subscriber's MSC 
server record. 

When a request for location information is received at the VMSC, MSC Server or SGSN, the request shall indicate 
whether the "last known location of the target UE" should be returned in case of a "detached" or "not reachable" target 
UE. 

If the VLR, MSC Server or SGSN has a valid copy of the subscriber's permanent data and the target UE's privacy 
settings are such that positioning is allowed, then the following two cases can occur. 

9.1 .4.5.1 Target UE is "Not Reachable" 

If the target UE is marked as "attached" in the VLR, MSC Server or SGSN, the corresponding entity orders paging of 
the target UE. If paging fails, due to target UE being "not reachable" then the corresponding VMSC, MSC Server or 
SGSN shall check whether the LCS client has requested "last known location" in case of "not reachable" target UE. 

If such a request exists and notification to the target UE does not apply for a value added LCS client, the VMSC, MSC 
Server or SGSN shall include the last known location together with the time stamp available in its response to the 
request for location information. 

An indicator of "last known location" returned shall be marked at the CDR at VMSC, MSC Server or SGSN 
correspondingly. 
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9.1 .4.5.2 Target UE is "Detached" 

If the target UE is marked as "detached" in the VLR, MSC Server or SGSN, the corresponding entity shall check 
whether the LCS client has requested "last known location" in case of "detached" target UE. 

If such a request exists and notification to the target UE does not apply for a value added LCS client, the VMSC, MSC 
Server or SGSN includes the "last known location" together with the time stamp available in its response to the request 
for location information. 

An indicator of "last known location" returned shall be marked at the CDR at VMSC, MSC Server or SGSN. 

9.1 .4.5.3 Target UE is Reachable but Positioning Fails 

If the target UE is reachable (e.g. paging succeeds), but the VMSC, MSC Server or SGSN is unable to obtain a current 
location estimate, then the corresponding entity shall check whether the LCS client has requested "last known location". 

If such a request exists and notification to the target UE either does not apply or was successfully executed for a value 
added LCS client, the VMSC, MSC Server or SGSN includes the "last known location" together with the time stamp 
available in its response to the request for location information. An indicator of "last known location" returned shall be 
marked at the CDR at VMSC. 

9.1 .4.5.4 MSC Server or SGSN Target UE is "Purged" 

If the target UE is marked as "Purged" in HLR/HSS, then an indication "Absent Subscriber" is returned to the GMLC. 



£75/ 



3GPP TS 23.271 version 11.1.0 Release 11 



69 



ETSI TS 123 271 V1 1.1.0 (2013-01) 



9.1 .5 Network Induced Location Request (NI-LR) 

Figure 9.4 illustrates how the initial position for an emergency service call is determined when the subscriber initiates 
the emergency call. 
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Figure 9.4: Positioning for a NI-LR Emergency Service Call 



Location Preparation Procedure 



1) An initially idle UE requests radio connection setup indicating a request for an Emergency Service call to the 
VMSC/MSC server via RAN. 

2) RAN shall convey the CM service request to the core network. (Before having a CM connection there must be a 
radio connection.) The UE may identify itself using a TMSl, IMSI or IMEI. 

3) The emergency call procedure is applied. The VMSC/MSC server determines based on the serving cell the 
appropriate emergency services client. The VMSC/MSC server, RAN and UE continue the normal procedure for 
emergency call origination towards that emergency services client. Depending on local regulatory requirements, 
the sending of call setup information into the PSTN may be delayed until either the UE's location has been 
obtained or the location attempt has failed or a PLMN defined timer has expired before location was obtained. If 
the serving cell serves an area that contains the service domain of multiple emergency services clients, the 
VMSC/MSC server may delay call setup and invoke location based routing procedures described in section 

9. 1.5 A. Call setup information sent into the PSTN may include the UE location (if already obtained) plus 
information that will enable the emergency service provider to request UE location at a later time (e.g. NA- 
ESRD or NA-ESRK in North America, or the ISUP/BICC lAM message with location number parameter set to 
MSC number and the calling party parameter set to MSISDN, in E.U.). 
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4) At any time after step 2, the VMSC/MSC server may initiate procedures to obtain the UE's location and 
optionally, velocity. These procedures may run in parallel with the emergency call origination. The VMSC/MSC 
server sends a Location Request message to RAN associated with the UE's current location area (see step 6 for a 
MT-LR). This message includes the QoS required for an emergency call. 

9.1 .5.2 Positioning Measurement Establishment Procedure 

5) RAN determines the positioning method and instigates the particular message sequence for this method, as 
specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

9.1 .5.3 Location Calculation and Release Procedure 

6) When a location estimate best satisfying the requested QoS has been obtained, RAN returns it to the 
VMSC/MSC server in a Location Report. As a national option. Cell ID positioning accuracy is allowed. RAN 
shall in its response include an indication whether the obtained location estimate satisfies the requested accuracy 
or not. The information of the positioning method used may be returned with the location estimate. If a location 
estimate could not be obtained, the RAN returns a location response containing a failure cause and no location 
estimate. 

7) Depending on local regulatory requirements, the VMSC/MSC server may send a MAP Subscriber Location 
report to a GMLC associated with the emergency services provider to which the emergency call has been or will 
be sent. This message shall carry any location estimate returned in step 6 including the indication received from 
RAN whether the obtained location estimate satisfies the requested accuracy or not, the age of this estimate and 
may carry the MSISDN, IMSI and IMEI of the calling UE, the information about the positioning method used 
and the serving cell identity or S AI of the UE. In case of a SIM-less emergency call, or a non-registered (U)SIM 
emergency call, the IMEI shall be always sent and the MSISDN may be populated with a non-dialable callback 
number as specified in clause 6.4.3. In North America, any NA-ESRD and any NA-ESRK that may have been 
assigned by the VMSC/MSC server shall be included. In the E.U. the VMSC/MSC Server shall provide the 
identity of the PSAP to which the emergency call was connected. The message shall also indicate the event that 
triggered the location report. If location failed (i.e. an error result was returned by RAN in step 6), an indication 
of failure rather than a location estimate may be sent to the GMLC: the indication of failure is conveyed by not 
including a location estimate in the MAP Subscriber Location Report. The MSC/MSC server may record 
charging information. 

8) The GMLC acknowledges receipt of the location information. The GMLC shall store the location information 
for later retrieval by the emergency services LCS client. 

9) The GMLC may optionally forward the information received in step 8 to the emergency services LCS client. The 
GMLC may also record charging information. The client is expected to obtain the location information by 
requesting it from the GMLC. The information about the positioning method used may be sent with the location 
information from the GMLC to the LCS client. 

10) At some later time, the emergency services call is released. 

1 l)The MSC/MSC server sends another MAP Subscriber Location Report to the GMLC. This message may include 
the same parameters as before except that there is no position estimate and an indication of emergency call 
termination is included. 

12) The GMLC acknowledges the MSC/MSC server notification and may then delete all information previously 
stored for the emergency call per national regulation. 
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9.1 .5A NI-LR using Location Based Routing - applicable to North American 
Emergency Calls only 

Figure 9.4A illustrates positioning for an emergency service call using location based routing. 
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Figure 9.4A: Positioning for a NI-LR Emergency Service Call using Location Based Routing 
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9.1.5A.1 Location Preparation Procedure 

1) An initially idle UE requests radio connection setup indicating a request for an Emergency Service call to the 
VMSC/MSC server via RAN. 

2) RAN shall convey the CM service request to the core network. (Before having a CM connection there must be a 
radio connection.) The UE may identify itself using a TMSI, IMSI or IMEI. 

3) The VMSC/MSC server determines that the serving cell serves an area that contains portions of multiple 
emergency services zones. Therefore, the VMSC/MSC server delays call setup and initiates procedures to obtain 
the UE's location for routing the emergency call to the emergency services LCS client. The VMSC/MSC server 
sends a Location Request message to RAN associated with the UE's current location area. This message includes 
the type of location information requested, the UE's location capabilities and a QoS with low delay and low 
horizontal accuracy. 

9.1 .5A.2 Positioning Measurement Establishment Procedure 

4) RAN determines the positioning method and instigates the particular message sequence for this method, as 
specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

9.1 .5A.3 Location Calculation and Release Procedure 

5) When a location estimate best satisfying the requested QoS has been obtained, RAN returns it to the 
VMSC/MSC server. If a location estimate could not be obtained, the RAN returns a location response containing 
a failure cause and no location estimate. If a failure is received, the VMSC/MSC server initiates emergency call 
setup using the normal NI-LR procedures. 

6) The VMSC/MSC server sends a MAP Subscriber Location Report to a GMLC associated with the emergency 
services provider to which the emergency call will be sent. This message shall carry any location estimate 
returned in step 5, the age of this estimate and may carry the MSISDN, IMSI, IMEI of the calling UE, the 
information about the positioning method used and the serving cell identity or S AI of the UE. In case of a SIM- 
less emergency call, or a non-registered (U)SIM emergency call, the IMEI shall be always sent and the MSISDN 
shall be populated with a non-dialable callback number as specified in clause 6.4.3. The message shall also 
indicate the event that triggered the location report. Any NA-ESRD and NA-ESRK that was assigned by the 
VMSC/MSC server shall be included. The message shall also include an indication that the VMSC/MSC server 
supports the capability to replace an NA-ESRK or NA-ESRD value with the one assigned by the GMLC. The 
VMSC/MSC server and GMLC may record charging information. 

7) The GMLC translates the location estimate into a zone identity and assigns either a NA-ESRK or a NA-ESRD, 
which was requested by the VMSC/MSC server. The GMLC shall include either the NA-ESRK value or the NA- 
ESRD value in the MAP Subscriber Location Report ack and send it to the VMSC/MSC server. The GMLC 
stores either the assigned NA-ESRD or the assigned NA- ESRK and any NA-ESRD that was sent by the 
VMSC/MSC server in step 6. 

9.1.5A.4 Location Preparation Procedure 

8) The emergency call procedure is applied. The VMSC/MSC server, RAN and UE continue the normal procedure 
for emergency call origination towards the appropriate emergency services client. Call setup information sent 
into the PSTN may include the UE location plus information that will enable the emergency service provider to 
request UE location at a later time (NA-ESRD or NA-ESRK in North America). The NA-ESRK or NA-ESRD 
used shall be the one received from the GMLC. If a NA-ESRK or NA-ESRD is not received from the GMLC 
then the VMSC/MSC server shall employ default routing for the call using a default NA-ESRK, default NA- 
ESRD or other default number as in 9. 1 .5. 1 step 3. 

9) At any time after step 8, the emergency services LCS client may request location information. 

10) At any time after step 6, the GMLC may send a MAP Provide Subscriber Location message to the VMSC/MSC 
server. This message includes a QoS with higher delay and higher horizontal accuracy required for an emergency 
call. In case of a SIM-less emergency call, or a non-registered (U)SIM emergency call, the IMEI shall be 
included in the message. 
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If the GMLC is capable of determining whether the initial location satisfies the higher accuracy requirements for 
an emergency call, then the GMLC may not need to request for a higher accuracy location. 

ll)The VMSC/MSC server sends a Location Request message to RAN. This message includes the type of location 
information requested, the UE's location capabilities and requested higher accuracy QoS. 

9.1 .5A.5 Positioning Measurement Establishment Procedure 

12) same as step 4. 

9.1 .5A.6 Location Calculation and Release Procedure 

13) same as step 5. 

14) The VMSC/MSC server returns the location information and its age, the information about the positioning 
method used and the serving cell identity or S AI of the UE to the GMLC. The GMLC shall replace the 
previously stored low accuracy location information with the higher accuracy information for later retrieval by 
the emergency services LCS client. The VMSC/MSC server and GMLC may record charging information. 

15) The GMLC may forward the information received in the previous step to the emergency services LCS client. 
The client is expected to have requested this information from GMLC before. The information about the 
positioning method used may be sent with this location information from the GMLC to the LCS client. 

16) same as step 10 for normal NI-LR. 

17) same as step 1 1 for normal NI-LR. 

18) same as step 12 for normal NI-LR. 

9.1 .6 Packet Switched Mobile Terminating Location Request 
(PS-MT-LR) 

Figure 9.5 illustrates the general network positioning for LCS clients external to the PLMN for packet switched 
services. In this scenario, it is assumed that the target UE is identified using an MSISDN or IMSI. 
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Figure 9.5: General Network Positioning for Packet Switched MT-LR 

9.1.6.1 Location Preparation Procedure 

1) Common PS and CS MT-LR procedure as described in 9.1.1. 

2) GMLC sends a Provide Subscriber Location message to the SGSN indicated by the HLR/HSS. This message 
carries the type of location information requested (e.g. current location and optionally, velocity), the UE 
subscriber's IMSl, LCS QoS information (e.g. accuracy, response time) and an indication of whether the LCS 
client has the override capability. For a session related location request, the message also carries the APN-Nl to 
which the user has established the session. For a value added LCS client, the message shall carry the client name, 
the external identity of the LCS client (or the pseudo external identity) and the Requestor Identity (if that is both 
supported and available), optionally the message may also carry the Service Type. Also the message may carry 
the type of the LCS client name and also the type of the Requestor identity if the requestor identity was included. 
If the result of the privacy check at H-GMLC/PPR indicated that the codeword shall be sent to the UE user, the 
message may carry also the codeword received from the LCS client. For a PLMN operator LCS client, the 
message shall carry the internal identity of the LCS client. If the Requestor Identity is provided, the GMLC shall 
send it as separate information. In addition, in order to display the requestor identity in case of pre rel-5 network 
elements (i.e. SGSN and/or UE), the requestor identity may be also added to the LCS client name by the GMLC. 
When the Requestor identity is added to the LCS client name the practise described in the Annex D should be 
followed. The message also shall carry the indicators of privacy related action which is described in chapter 
9.5.4 , if it is provided by H-GMLC. 
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3) If the GMLC is located in another PLMN or another country, the SGSN first authenticates that a location request 
is allowed from this PLMN or from this country. If not, an error response is returned. If the PSL message from 
the GMLC includes the indicators of privacy related action, the SGSN determines a required privacy related 
action as described in Annex A. 3. If the PSL message from the GMLC does not include the indicators of privacy 
related action, the SGSN then verifies LCS barring restrictions in the UE user's subscription profile in the SGSN. 
In verifying the barring restrictions, barring of the whole location request is assumed if any part of it is barred or 
any requisite condition is not satisfied. If LCS is to be barred without notifying the target UE and a LCS client 
accessing a GMLC in the same country does not have the override capability, an error response is returned to the 
GMLC. 

Otherwise, if the UE is in idle mode, the SGSN performs paging. The paging procedure is defined in 
TS 23.060 [15]. 

4) Security functions may be executed. These procedures are defined in TS 23.060 [15]. 

5) If the location request comes from a value added LCS client and the indicators of privacy related action or the 
UE subscription profile indicates that the UE must either be notified or notified with privacy verification and the 
UE supports notification of LCS, a notification invoke message is sent to the target UE indicating the type of 
location request from the LCS Client (e.g. current location or "current or last known location") and the identity 
of the LCS client and the Requestor Identity (if that is both supported and available), whether privacy 
verification is required. Also the message may indicate the type of the LCS client name and also the type of the 
Requestor identity if the requestor identity was included. Moreover, the message may carry also the service type 
and the codeword. Optionally, the SGSN may after sending the LCS Location Notification Invoke message 
continue in parallel the location process, i.e. continue to step 7 without waiting for a LCS Location Notification 
Return Result message in step 6. 

6) The target UE notifies the UE user of the location request and, if privacy verification was requested, waits for the 
user to grant or withhold permission. The UE then returns a notification result to the SGSN indicating, if privacy 
verification was requested, whether permission is granted or denied. Optionally, this message can be returned 
some time after step 5, but before step 10. If the UE user does not respond after a predetermined time period, the 
SGSN shall infer a "no response" condition. The SGSN shall return an error response to the GMLC if privacy 
verification was requested and either the UE user denies permission or there is no response with the UE 
subscription profile indicating barring of the location request. 

7) The SGSN sends a Location Request message to the RAN. This message includes the type of location 
information requested, the requested QoS and any other location information received in paging response. 

9.1 .6.2 Positioning Measurement Establishment Procedure 

8) If the requested location information and the location accuracy within the QoS can be satisfied based on 
parameters received from the SGSN and the parameters obtained by the RAN e.g. cell coverage and timing 
information (i.e. RTT or TA), the RAN may send a Location Report immediately. Otherwise, the RAN 
determines the positioning method and instigates the particular message sequence for this method in UTRAN 
Stage 2 TS 25.305 [1] and in GERAN Stage 2 TS 43.059 [16]. If the position method returns position 
measurements, the RAN uses them to compute a location estimate. If there has been a failure to obtain position 
measurements, the RAN may use the current cell information and, if available, RTT or TA value to derive an 
approximate location estimate. If an already computed location estimate is returned for an UE based position 
method, the RAN may verify consistency with the current cell and, if available, RTT or TA. If the location 
estimate so obtained does not satisfy the requested accuracy and sufficient response time still remains, the RAN 
may instigate a further location attempt using the same or a different position method. If a vertical location 
co-ordinate is requested but the RAN can only obtain horizontal co-ordinates, these may be returned. 
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9.1.6.3 



Location Calculation and Release Procedure 



9) When location information best satisfying the requested location type and QoS has been obtained, the RAN 
returns it to the SGSN in a Location Report message. RAN shall in its response include an indication whether the 
obtained location estimate satisfies the requested accuracy or not. The information of the positioning method 
used may be returned with the location information. If a location estimate could not be obtained, the RAN 
returns a Location Report message containing a failure cause and no location estimate. 

10) The SGSN returns the location information, its age and obtained accuracy indication to the GMLC, if the SGSN 
has not initiated the Privacy Verification process in step 5. If step 5 has been performed for privacy verification, 
the SGSN returns the location information only, if it has received a LCS Location Notification Return Result 
indicating that permission is granted. In these cases, the information about the positioning method used may be 
sent with the location information. If a LCS Location Notification Return Result message indicating that 
permission is not granted is received, or there is no response, with the requested privacy action or the UE 
subscription profile indicating barring of location, the SGSN shall return an error response to the GMLC. If the 
SGSN did not return a successful location estimate, but the privacy checks were successfully executed, the 
SGSN may return the last known location of the target UE if this is known and the LCS client is requesting the 
current or last known location. The SGSN may record charging information. 

11) Common MT-LR procedure in PS and CS domain as described in 9.1.1. 

9.1 .6A PS-MT-LR without HLR Query 

Figure 9.5A illustrates current or last known location requests for an emergency services call, where an emergency 
services client (i.e., a Public Safety Answering Point) identifies the target UE and the serving GMLC using correlation 
information that was previously provided to it by the IMS Core. The signalling used to provide the correlation 
information to the PSAP is out of scope of this TS, but is presumed to occur on the signalling for the call. The 
correlation information may be used by the GMLC to retrieve other information previously provided to it by the IMS 
Core as per TS 23.167 [36a] and/or SGSN as described in clause 9.1.7. This allows the requesting V-GMLC to request 
location from the SGSN without first querying the home HLR of the target UE. This scenario therefore supports 
location of emergency calls from roamers or SIM-less emergency calls, or non-registered (U)SIM emergency calls, and 
requires that the initial location, as well as UE and SGSN identifying information had been pushed to the GMLC as per 
clause 9.1.7 or as per TS 23.167 [36a]. 
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Figure 9.5A: Positioning for a Emergency Services PS-IUIT-LR without HLR Query 

1) Same as step 1 in figure 9.1 but with the LCS client (PSAP) identifying first the target UE and the serving 
V-GMLC by previously supplied correlation information for the emergency call. 
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2) The GMLC may determine the SGSN by associating the correlation information received from the PSAP with 
other information received previously from the SGSN using a PS-NI-LR and/or from the IMS core. The 
MAP_PROVIDE_SUBSCRIBER_LOCATION message sent to the SGSN carries, if available, the MSISDN or 
the IMSI and, if available, the IMEI for the target UE, as well as the required QoS and an indication of a location 
request from an emergency services client. The SGSN identifies the target UE using the IMSI, MSISDN and/or 
the IMEI. In case of a SIM-less emergency call, or non-registered (U)SIM emergency call, the IMEI shall be 
always sent. 

3) The SGSN verifies that UE privacy is overridden by the emergency services provider and that positioning is not 
prevented for other reasons (e.g. unreachable UE). The SGSN then sends a Location Request to the RAN, as for 
a normal PS-MT-LR. 

4) RAN performs positioning as for a normal PS-MT-LR. 

5) RAN returns a location estimate to the SGSN as for a normal PS-MT-LR. 

6) The SGSN returns the location information, its age and obtained accuracy indication to the GMLC. The 
information about the positioning method used may be sent with the location information. If the RAN did not 
return a successful location estimate, the SGSN may return the last known location of the target UE if this is 
known and the LCS client is requesting the current or last known location. 

7) The GMLC sends the location service response to the LCS client (PSAP). 

NOTE: The SGSN determined by the GMLC in step 2 must be the current SGSN for the UE. In the event of 
handover to a new SGSN, this may require updating of the GMLC using the PS-NI-LR procedure in 
clause 9.1.7. Before any handover has occurred, this may require using the cell ID or SAI for the UE 
provided by the IMS Core. 

9.1 .7 Packet Switched Network Induced Location Request (PS-NI-LR) 

At any time after detecting an emergency situation (i.e. after emergency Attach or Service Request for emergency, PDP 
context activation towards emergency APN), the SGSN may initiate the Packet Switched Network Induced Location 
Request (PS-NI-LR) procedure. At any time after the handover or relocation of an emergency PDP context from an old 
to a new SGSN, where the old SGSN indicates that a PS-NI-LR is still needed, the new SGSN may initiate a PS-NI-LR 
to the GMLC indicated by the old SGSN. At any time after the handover or relocation of an emergency PDP context 
from an old to a new SGSN, where the old SGSN indicates that a PS-NI-LR is not needed but provides a GMLC 
address, the new SGSN may initiate a PS-NI-LR procedure to transfer its address to the GMLC indicated by the old 
SGSN in order to support a later PS-MT-LR. The procedure is illustrated in figure 9.6. 
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Figure 9.6: Network Induced Location Request for the PS Domain 
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1) The SGSN sends a Location Request message to the RAN. This message indicates the type of location 
information requested and requested QoS. If the location of the UE is not required (e.g. the SGSN is only 
sending its address to the GMLC), the SGSN skips both this step and steps 2 and 3. 

9.1 .7.1 Positioning Measurement Establishment Procedure 

2) If the requested location information and the location accuracy within the QoS can be satisfied based on 
parameters received from the SGSN and the parameters obtained by the RAN e.g. cell coverage and timing 
information (i.e. RTT or TA), the RAN may send a Location Report immediately. Otherwise, the RAN 
determines the positioning method and instigates the particular message sequence for this method. If the position 
method returns position measurements, the RAN uses them to compute a location estimate. If there has been a 
failure to obtain position measurements, the RAN may use the current cell information and, if available, RTT or 
TA value to derive an approximate location estimate. If an already computed location estimate is returned for an 
UE based position method, the RAN may verify consistency with the current cell and, if available, RTT or TA 
value. If the location estimate so obtained does not satisfy the requested accuracy and sufficient response time 
still remains, the RAN may instigate a further location attempt using the same or a different position method. If a 
vertical location co-ordinate is requested but the RAN can only obtain horizontal co-ordinates, these may be 
returned. 

9.1 .7.2 Location Calculation and Release Procedure 

3) When a location estimate best satisfying the requested QoS has been obtained, the RAN returns a Location 
Report to the SGSN with an indication whether the obtained location estimate satisfies the requested accuracy or 
not. This message carries the location estimate that was obtained. If a location estimate was not successfully 
obtained, a failure cause is included in the Location Report. 

4) The SGSN may determine the GMLC and emergency services client using the SAI or cell identity, the location 
estimate if obtained or information received from a previous SGSN in the case of SRNS relocation, RAU or 
handover. The SGSN shall send a MAP Subscriber Location Report to the GMLC carrying the MSISDN of the 
UE, the identity of the LCS client, the event causing the message (PS-NI-LR), and, if these were obtained in 
steps 1 to 3, the location estimate and its age and the indication received from RAN whether the obtained 
location estimate satisfies the requested accuracy or not. The serving cell identity or SAI of the UE may also be 
sent. The SGSN may include its own address. If the UE was not authenticated, the IMEI shall be included. The 
SGSN may record charging information. 

5) The GMLC shall acknowledge receipt of the location estimate provided that it serves the identified LCS client 
and the client is accessible. 

6) The GMLC may transfer the location information to the LCS client either immediately or upon request from the 
client. The GMLC may store the information received in step 4: e.g. may store the UE identity and the address of 
the SGSN. The GMLC may record charging information. 

NOTE: Determination of the GMLC in step 4 must ensure a match with any GMLC used by the IMS Core to 
assist with location retrieval for, and/or routing of, the IMS Emergency call. 

9.1 .8 Mobile Terminating Deferred Location Request - UE available event 

Figure 9.6a illustrates the procedures for a Deferred Location Request, where the Location Report is returned based on a 
UE available event. 
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Figure 9.6a: General Network Positioning for a Deferred MT-LR with UE available event 



9.1.8.1 Deferred Location Request Procedure 

1) The LCS Service Request shall contain an indication of the requested event i.e. UE available. 

2) LCS service request handling between GMLCs as described in clause 9.1.1. The information received by the R- 
GMLC is transferred to the H-GMLC. The H-GMLC assigns a LDR reference number to this LCS Service 
request and transfers the information to the V-GMLC, including the LDR reference number and the H-GMLC 
address. 

3) The V-GMLC sends the UE available event to MSC/SGSN in the Provide Subscriber Location request (deferred) 
and includes the LDR reference number and the H-GMLC address in the request. 

NOTE: It shall be possible to issue the deferred location requests for the UE available event, even in case there is 
an ongoing previous MT-LR for the same UE. 

4) If the SGSN/MSC cannot support the deferred location request for the specified event (for temporary or 
permanent reasons), or if either the security or privacy check related actions fail, then a Provide Subscriber 
Location return error shall be returned with a suitable cause. If the SGSN/MSC can support the deferred location 
request for the specified event, a Provide Subscriber Location ack. shall be returned to the V-GMLC without a 
location estimate. The SGSN/MSC may record charging information for an accepted deferred location request. 

5) V-GMLC returns the LCS Service Response to H-GMLC to notify whether the request was successfully 
accepted or not. The V-GMLC may record charging information for an accepted deferred location request. 
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6) H-GMLC returns the LCS Service Response to R-GMLC to notify whether the request was successfully 
accepted or not. When the H-GMLC returns the LCS Service Response to the R-GMLC, the LDR reference 
number assigned by the H-GMLC shall be included. The H-GMLC may record charging information for an 
accepted deferred location request. 

7) The R-GMLC then returns the LCS Service Response with LDR reference number to the LCS Client to notify 
whether the request was successfully accepted or not. The R-GMLC may record charging information for an 
accepted deferred location request. 

9.1.8.2 Location Report Procedure 

8) Immediately following step 3, the SGSN/MSC shall verify if the requested event is already satisfied (e.g. UE 
available inferred from a current transaction) or can be invoked immediately (e.g. by paging the UE and 
receiving a page response). If the requested event is not already satisfied, the SGSN/MSC waits until it has 
occurred or until some maximum time has expired. 

In case the SGSN/MSC receives an indication that the UE has moved to another SGSN/MSC, while it is waiting 
for the requested event to happen, SGSN/MSC shall immediately send a Subscriber Location Report to the V- 
GMLC. The report shall include the reference number and H-GMLC address that were included in the Provide 
Subscriber Location request and the information that the MT-LR must be reinitiated against the new 
SGSN/MSC. It shall also include the address of the new SGSN/MSC, if available. If the V-GMLC is associated 
with the new MSC/SGSN, it re-issues the location request to the new MSC/SGSN. Otherwise the V-GMLC 
forwards the responses to the H-GMLC. If the H-GMLC already knows (e.g. from a previous location request or 
an internal lookup table), or is able to determine, (e.g. it is possible to use a DNS lookup mechanism similar to 
IETF RFC 2916), the network address of the V-GMLC, it reinitiates the MT-LR to the new SGSN/MSC through 
the new V-GMLC. Otherwise, the H-GMLC shall then issue a SEND_ROUTING_INFO_FOR_LCS message to 
get the address of the V-GMLC associated with the new SGSN/MSC and reinitiate the MT-LR with the new 
SGSN/MSC through the new V-GMLC, see step 12. 

9) When the requested event is detected, the SGSN/MSC shall proceed with the location request as described in 
9.1.2/9.1.6. If an LCS Location Notification Invoke message is sent to the target UE as defined in step 4 of 
clause 9.1.2.1 and step 5 of clause 9.1.6.1, the type of location request shall indicate current location and the 
deferred location event type shall be omitted. 

If either security or privacy check related actions fail, the SGSN/MSC shall send a Subscriber Location Report 
with the reference number and H-GMLC address that was included in the Provide Subscriber Location with 
appropriate error cause indicating termination of the deferred location request. 

10) When location information has been obtained from the RAN, the SGSN/MSC returns the Subscriber Location 
Report. The report shall include the reference number that was included in the Provide Subscriber Location, the 
H-GMLC address, an indication that this is a response to a previously sent deferred location request and may 
also include the indication whether the obtained location estimate satisfies the requested accuracy or not 
(provided that this indication is obtained from RAN with the location estimate). The SGSN/MSC may record 
charging information. 

If the location information could not be obtained, or the SGSN/MSC for some other reason decides to not wait 
any longer for the requested event to occur (ex. timer expires), the Subscriber Location Report with the reference 
number and H-GMLC address that was included in the Provide Subscriber Location will be returned with an 
appropriate error cause indicating termination of the deferred location request. 

1 1) V-GMLC sends the LCS Service Response to the H-GMLC with an indication of the event occurrence and the 
LDR reference number. The LCS Service Response is sent in accordance with the requested QoS Class, as 
described in clause 9.1.1 for common MT-LR. 

12)In case the LCS Service Response indicates to H-GMLC that the mobile has moved to another SGSN/MSC, the 
H-GMLC shall send the deferred MT-LR with UE available event to the V-GMLC (previous or new), which 
forwards the request to the new SGSN/MSC, as described in step 2 onwards. 

13) The H-GMLC performs the privacy check as described in clause 9.1.1. 

14) The H-GMLC sends the LCS Service Response to R-GMLC. When the H-GMLC returns the LCS Service 
Response to the R-GMLC, the LDR reference number that was sent to the R-GMLC in step 6 shall be included. 

15) The R-GMLC sends the LCS Service Response with the LDR reference number to the LCS Client. 
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9.1 .8.3 Combined Periodical/Deferred Mobile Terminating Location Request with UE 

available event 

Figure 9.6b illustrates the procedures for a Combined Periodical/Deferred Mobile Terminating Location Request with 
UE available event, where the response to the LCS client is returned periodically and based on the event. This clause is 
applicable only to the case, when the R-GMLC handles the periodicity of the location requests. The case when the UE 
handles the periodicity of location reporting, as specified in clause 9.1.12, is independent of this clause. 

NOTE: In the description below, it is assumed that the LCS client issues the Periodical/Deferred MT-LR with 
only the location estimate type of "current location". 
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Figure 9.6b: General Network Positioning for a Combined Periodical/Deferred MT-LR 

1) When a R-GMLC receives a LCS Service Request from a LCS client, the R-GMLC verifies the identity of the 
LCS client as described in 9. LI, then the R-GMLC transfers the periodical request to the H-GMLC. 

2) The H-GMLC starts the periodical timer and assigns a LDR reference number for this periodical request, and 
initiates the common LCS procedures as described in 9.LL 
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3) The V-GMLC sends a Deferred Location Request to the SGSN/MSC by means of Provide Subscriber Location 
as described in 9.L2/9.L6. In addition, the Deferred Location Request includes the reference number assigned 
by the H-GMLC and the event that shall trigger the sending of Subscriber Location Report. 

4) If the SGSN/MSC cannot support the deferred location request for the specified event or the LCS client is not 
allowed to position the requested UE according to subscription information, a Provide Subscriber Location error 
is returned to the V-GMLC. If the SGSN/MSC can support the deferred location request for the specified event 
and the privacy checks are satisfied, a Provide Subscriber Location ack shall be returned to the V-GMLC 
without a location estimate. The SGSN/MSC may record charging information for an accepted deferred location 
request. 

5) The V-GMLC then returns the LCS Service Response to the LCS Client via H-GMLC and R-GMLC to notify 
whether the request was successfully accepted or not. The V-GMLC, H-GMLC and R-GMLC may record 
charging information for an accepted deferred location request. When the H-GMLC returns the LCS Service 
Response to the LCS Client via R-GMLC, the LDR reference number assigned by the H-GMLC shall be 
included. 

6) When the periodical timer expires, if the H-GMLC is still waiting for the event, the H-GMLC shall send a LCS 
Service Response to the LCS client via R-GMLC, indicating that the location is not available at that moment. 
The LDR reference number that was sent to the LCS Client in step 5 shall be included in the response. 

7) When the requested event is detected, the SGSN/MSC will proceed with the location request as described in 
9.L2/9.L6. If an LCS Location Notification Invoke message is sent to the target UE as defined in step 4 of 
clause 9.1.2.1 and step 5 of clause 9.1.6.1, the type of location request shall indicate current location and the 
deferred location event type shall be omitted. 

8) When location information has been obtained from the RAN, the SGSN/MSC returns the Subscriber Location 
Report. The report shall include the reference number included in the previously sent Provide Subscriber 
Location and an indication that this is a response to a previously sent deferred location request. The SGSN/MSC 
may record charging information. 

If the location information could not be obtained, or the SGSN/MSC for some other reason decides to not wait 
any longer for the requested event to occur (ex. timer expires), the Subscriber Location Report with the reference 
number included in the previously sent Provide Subscriber Location will be returned with an appropriate error 
cause indicating termination of the deferred location request. 

9) The V-GMLC then returns the LCS Service Response to the LCS Client via H-GMLC and R-GMLC as in 
9.L2/9.L6. When the H-GMLC returns the LCS Service Response to the LCS CUent via R-GMLC, the LDR 
reference number that was sent to the LCS Client in step 5 shall be included. 

10) When the timer expires, if the H-GMLC is not waiting for the event, the H-GMLC initiates the common LCS 
procedures as described in 9.L1. The H-GMLC should use the same LDR reference number assigned in the step 
2, should NOT assign a new LDR reference number. 

11) Same as step 3. 

12) Same as step 4. 

13) Same as step 5. 

14) If the requested event is already satisfied, the SGSN/MSC will proceed with the location request as described in 
9.1.2/9.1.6. If an LCS Location Notification Invoke message is sent to the target UE as defined in step 4 of 
clause 9.1.2.1 and step 5 of clause 9.1.6.1, the type of location request shall indicate current location and the 
deferred location event type shall be omitted. 

15) Same as step 8. 

16) Same as step 9. 
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9.1.8.4 



Cancellation of a Deferred Location Request- UE available event 
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Figure 9.6c: Cancellation of a Deferred MT-LR - UE available event procedure 

1) The LCS Client requests the cancellation of a previously requested Deferred Location Request. The LDR 
reference number that was included in the previous LCS Service Response sent by the GMLC shall be included 
in the request to indicate which outstanding LDR should be cancelled. 

2) The R-GMLC sends the cancellation request to H-GMLC, including the LDR reference number. The 
cancellation could be initiated by the R-GMLC itself for some reasons (e.g. the expiry of the validity timer 
specified by the start time and stop time; or the expiry of an implementation dependent timer specified by the 
Operator as a default value in the R-GMLC when the stop time is undefined or exceeds the maximum allowed 
value). 

3) The H-GMLC forwards the LCS Cancel Service Request to V-GMLC with the LDR reference number which is 
received from the R-GMLC, and the H-GMLC address. The H-GMLC may itself initiate the cancellation 
procedure, e.g. if an implementation dependent timer in the H-GMLC expired, or when the UE's privacy profile 
stored in the H-GMLC or in the PPR was changed. For every outstanding Deferred Location Request against that 
UE, the H-GMLC shall perform or ask the PPR to perform a new privacy check based on the updated privacy 
profile. If the privacy check passes, i.e. the LCS Client is still allowed to position the target UE, the handling of 
the outstanding Deferred Location Request should be continued. Otherwise, if the privacy check does not pass, 
i.e. the Location estimate of the target UE is not allowed to be provided to the LCS Client, the H-GMLC shall 
initiate a cancellation procedure. 

NOTE: The H-GMLC shall know that the UE subscriber's privacy profile has been changed in the PPR when the 
LCS Privacy Profile Update has been sent from PPR to H-GMLC as described in 9.LL2. 

4) The V-GMLC will indicate this cancellation request in the Provide Subscriber Location toward the SGSN/MSC. 
The Provide Subscriber Location shall include the H-GMLC address, and the reference number specified by 
LCS Client in the LCS Cancel Service Request. 

5) When the SGSN/MSC completes the cancellation procedure, it notifies it to the V-GMLC in the Provide 
Subscriber Location Ack (with no location estimate included). 

6) The V-GMLC sends the LCS Cancel Service Response to H-GMLC. 

7) H-GMLC sends the LCS Cancel Service Response to R-GMLC. H-GMLC may send the LCS Cancel Service 
Response to R-GMLC, even if the R-GMLC/LCS client has not requested the cancellation, see step 3. 

8) The R-GMLC sends the LCS Cancel Service Response to the LCS Ghent. 
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9.1 .9 Deferred Location Request Procedure for the change of area event 

Figure 9-6d illustrates the procedures for a Deferred Location Request where the Location Report is returned to the 
network by the UE following a change of area event. An area event occurs when the UE leaves, enters or is within a 
target area as defined by geographical area, PLMN identity, country code or geopolitical name of the area. Details of 
the target area are contained in the LCS Service Request message, see clause 5.5.1. 

The PLMN operator may choose to use another mechanism (such as SIM Application Toolkit) for the transfer and 
detection mechanism of the Area Definition and change of area event information to the UE. In this case, the GMLCs 
handle steps 2 to 7 and 11 to 14 differently from that shown below. An alternative mechanism is detailed in Annex F 
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Figure 9.6d: Deferred MT-LR procedure for the Area event 

1) The LCS Service Request contains the change of area type deferred location request information, i.e. details of 
the target area and the nature of the event, whether the event to be reported is the UE being inside, entering into 
or leaving the target area. The LCS service request may specify the validity time, i.e. start time and stop time, for 
the deferred location request and R-GMLC may cancel the deferred location request as described in clause 
9.1.9.1. In addition, when validity time of a pending area event request in the target UE expires, the UE shall 
delete the pending deferred location request. The LCS Service Request shall contain an indication of the 
minimum interval time between area event reports, if applicable. The LCS service request shall contain the 
information whether the deferred area event may be reported one time only, or several times. If the change of 
area event is reported one time only, the Location Service request shall be completed after the first area event has 
occurred. If the target area is expressed by local coordinate system or geopolitical name, the R-GMLC shall 
convert the target area to geographical area expressed by a shape defined in TS 23.032 [11]. In addition to the 
target area definition, the LCS Client may include the country code of the target area in the area event request. 
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2) LCS service request handling between GMLCs as described in clause 9.1.1. The information received by the R- 
GMLC is transferred to the H-GMLC. If indication of the requested location estimate is included in the area 
event request, the H-GMLC should record this indication and any relevant parameters such as QoS. The H- 
GMLC assigns a LDR reference number to this LCS Service request then transfers the information to the V- 
GMLC, including the LDR reference number and the H-GMLC address. 

If the H-GMLC notices that the current visited PLMN does not serve the target area, it may generate a modified 
deferred LCS service request in order to get notified when the target UE enters a PLMN that serves the target 
area. The modified target area event is that the target UE enters one of the PLMNs that serve the original target 
area. Note that the new area event may include multiple PLMNs (identified by PLMN IDs) if there are more than 
one PLMN that serves the original target area, based on the stored PLMN list and the corresponding estimated 
coverage. The H-GMLC then generates a new location request with the new defined area event and the same rest 
of the information in the original request. 

The new location request is sent to the target UE via the current V-GMLC. The H-GMLC keeps the original area 
event location service request pending for as long as determined by the validity time of the request. When the 
UE enters one of the pre-defined PLMNs, it sends an area event location report to H-GMLC. The H-GMLC then 
sends the original area event location service request to the UE via the new V-GMLC. If the H-GMLC cannot 
derive a list of PLMNs that may cover the target area, and the current visited network does not cover the target 
area, the H-GMLC may reject the request. 

3) If the received target area is expressed by a shape defined in TS 23.032 [11], V-GMLC converts the target area 
into an Area Definition consisting of the corresponding list of cell identities, location areas or routing area. If the 
V-GMLC is not able to translate the target area into network identities, it shall reject the request and send an 
LCS service response to H-GMLC with the appropriate error cause. 

If the received target area is expressed by country code or PLMN identity, the V-GMLC shall use the country 

code or PLMN identity as the Area Definition. 

The V-GMLC sends the Area Definition to MSC/SGSN in the Provide Subscriber Location request (deferred) 

and includes the LDR reference number and the H-GMLC address in the request. 

The message shall define whether the event to be reported is the UE being inside, entering into or leaving the 

area. The message shall also include the validity period of the location request, the minimum interval time 

between area event reports, the information whether the deferred area event may be reported one time only or 

several times, if applicable. 

4) The MSC/SGSN verifies the UE capabilities with regard to the change of area event. If either the MSC/ SGSN 
or the UE does not support the deferred location request for the change of area event (for temporary or 
permanent reasons), a Provide Subscriber Location return error shall be returned with a suitable cause in step 7. 
If the UE is in idle mode, the core network performs paging, authentication and ciphering. If privacy 
notification/verification is requested, the MSC/SGSN sends an LCS Location Notification Invoke message to the 
target UE with a location type indicating activation of a deferred location request, a deferred location event type 
containing the change of area types requested and an indication as to whether privacy verification is required. 
LCS Location Notification is further specified in clauses 9.1.2 and 9.1.6. If privacy verification was requested, 
the UE returns an LCS Location Notification Return Result to the MSC/SGSN indicating whether permission is 
granted or denied. If a previous deferred location request is ongoing in the UE and the MSC/SGSN proceeds 
with the current deferred request, the UE may return an LCS Location Notification Return Error response to the 
MSC/SGSN indicating that the new request cannot be supported. 

5) The MSC/SGSN sends the LCS Area Event Invoke to the UE carrying the Area Definition, other area event 
information, the LDR reference number and the H-GMLC address. The message shall also define whether the 
event to be reported is the UE being inside, entering into, leaving the area. The message shall also include the 
validity period of the location request, the minimum interval time between area event reports and the information 
whether the deferred area event may be reported one time only, or several times, if applicable. 
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6) If the LCS Area Event Invoke is successfully received by the UE and the UE supports the change of area type 
deferred location request, the UE sends acknowledgement to MSC/SGSN and begins monitoring for the change 
of area event. The UE shall determine whether it is inside, entering into or leaving the target area by comparing 
the current serving cell identity, location area, routing area, PLMN identity or country code to the Area 
Definition received from the MSC/SGSN. In case of soft handover, it is sufficient if one of the cells belongs to 
the target area. In case the Area Definition consists of a location or routing area, PLMN or country identity the 
UE shall check for the area event during the normal location or routing area update procedure. The change of 
area event detection mechanism must not influence on the normal UE cell selection and reselection procedures. 
If the UE does not support the deferred location request (for temporary or permanent reasons), it shall send the 
LCS Area Event Invoke ack. with the appropriate error cause. If a previous deferred location request is still 
ongoing in the UE, the UE may return an LCS Area Event Return Error response to the MSC/SGSN indicating 
that the new request cannot be supported. 

7) If either the MSC/ SGSN or the UE does not support the deferred location request for the change of area event 
(for temporary or permanent reasons), a Provide Subscriber Location return error shall be returned to the V- 
GMLC with a suitable cause. If both of the SGSN/MSC and UE supports the deferred location request for the 
change of area event, a Provide Subscriber Location ack. shall be returned to the V-GMLC without a location 
estimate. MSC/SGSN shall include the result of the notification/verification in the response to the V-GMLC, if 
the notification/verification is needed. The response message shall include the LDR reference number and the H- 
GMLC address. The change of area event invoke result shall be also included, if necessary. After sending the 
Provide Subscriber Location ack to the V-GMLC, the deferred location request shall be completed in the 
MSC/SGSN. The SGSN/MSC may record charging information for an accepted area event request. 

8) to 10) V-GMLC returns the LCS Service Response via H-GMLC and R-GMLC to the LCS Client to notify 

whether the request was successfully accepted or not. When the H-GMLC returns the LCS Service Response to 
the R-GMLC, the LDR reference number assigned by the H-GMLC shall be included, then the R-GMLC shall 
transfer the LDR reference number to the LCS Client in the LCS Service Response. After sending the LCS 
Service Response to the H-GMLC, the deferred location request shall be completed in the V-GMLC. The V- 
GMLC or R-GMLC may record charging information for an accepted area event request. 

11)UE detects that the requested area event has occurred. 

12) Before sending the LCS Area Event Report the UE shall establish either a CS radio connection or PS signalling 
connection as specified in clauses 9.2.1 and 9.2.2. The UE sends the LCS Area Event Report to the 
VMSC/SGSN including the original LDR reference number and the H-GMLC address. The report shall also 
include the result of the notification/verification procedure, if the notification/verification is needed. 

When the MSC/SGSN receives the report and it can handle this report, an acknowledgement as a response 
should be sent to the UE. If the UE does not receive any response from the MSC/SGSN after sending the report, 
i.e. the current MSC/SGSN does not support the deferred location request for the area event (for temporary or 
permanent reasons), the UE may re-send the report more times. If the UE always does not receive the response, 
the UE shall stop sending the report, then record a corresponding flag to indicate that a report has been sent 
unsuccessfully. When the UE performs location update and detects the LAI or RA is changed, if the flag has 
been set, the UE shall send the report to the corresponding MSC/SGSN, and the flag will be cleared upon a 
success of the sending. 

If the UE was requested to report the change of area event one time only, the deferred location request shall be 
completed. In case multiple reports were requested, the UE must not send a repeated LCS Area Event Report 
more often than the requested minimum interval indicated in the LCS Area Event Invoke. 

Editor's Note: It could be useful to have MSC/SGSN repeat the notification procedure with the target UE after the 
UE has reported the change of area event, but this is for further study. 

13) The MSC/SGSN sends the subscriber location report to its associated V-GMLC with an indication of the event 
occurrence, the LDR reference number, the H-GMLC address and may also include the indication whether the 
obtained location estimate satisfies the requested accuracy or not (provided that this indication is obtained from 
RAN with the location estimate). V-GMLC sends an acknowledgement to MSC/SGSN in step 13b and the 
MSC/SGSN may record charging information. 

14) The V-GMLC sends the LCS Service Response to the H-GMLC with an indication of the event occurrence, the 
LDR reference number and the H-GMLC address. The LCS Service Response is sent in accordance with the 
requested QoS Class, as described in clause 9.1.1 for common MT-LR. The LDR reference number and the H- 
GMLC address will be used to identify the source of the original deferred location request in the case that the UE 
has relocated before the area event occurred. The V-GMLC may record charging information. 
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15) In case the UE moves to another PLMN of the PLMN identities list, according to the PLMN identity the UE 
shall determine whether the Area Definition of the target area is available. If it is not available, the UE shall 
report that it has roamed into a new PLMN, including the new PLMN identity and the LDR reference number. 
The H-GMLC shall transfer the original area event request to the V-GMLC of the new PLMN. The procedure 
should be continued as described in step 2 and onwards where the Area Definition of the new PLMN shall be 
downloaded to the UE. Otherwise, the UE monitors the area event in the new PLMN, does not inform the H- 
GMLC that it has entered into a new PLMN. 

16) The H-GMLC performs the privacy check as described in clause 9.1.1. 

17) If the H-GMLC finds the indication of the requested location estimate is stored, the H-GMLC should generate a 
new immediate LCS Service Request with the QoS specified in the original request. Then the H-GMLC sends 
the new request as described in clause 9.1.1 to the V-GMLC and waits the result the location request, the 
subsequent procedures in clause 9.1.1 are continued. 

The H-GMLC sends the LCS Service Response to R-GMLC with the LDR reference number. If the location 
estimate of the target UE is requested in the request and the location estimate was successfully obtained, the H- 
GMLC shall put the obtained location estimate into the LCS Service Response. If the location estimate of the 
target UE is requested in the request but the location estimate could not be obtained, the H-GMLC sends the 
LCS Service Response without the location estimate. Unless multiple reports were requested, the deferred 
location request shall be completed in the H-GMLC after sending the LCS Service Response to the R-GMLC. 
The H-GMLC may record charging information. 

18) The R-GMLC sends the LCS Service Response to the LCS client. Unless multiple reports were requested, the 
deferred location request shall be completed in the R-GMLC after sending the LCS Service Response to the LCS 
client. The R-GMLC may record charging information. 

9.1 .9.1 Cancellation of a Deferred Location Request - Change of Area event 

Figure 9-7b illustrates the procedure for cancelling the Deferred Location Request for the change of area event. 
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Figure 9.7b: Cancellation of a Deferred MT-LR with change of area event procedure 

1) The LCS Client requests the cancellation of a previously requested Deferred Location Request. The LDR 

reference number that was included in the previous LCS Service Response sent by the GMLC shall be included 
in the request to indicate which outstanding LDR should be cancelled. 
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2) The R-GMLC sends the cancellation request to H-GMLC, including the LDR reference number. R-GMLC may 
itself initiate the cancellation for some other reason, e.g. the expiry of the validity timer specified by the start 
time and stop time; or the expiry of an implementation dependent timer specified by the Operator as a default 
value in the R-GMLC when the stop time is undefined or exceeds the maximum allowed value. 

3) The H-GMLC forwards the LCS Cancel Service Request to V-GMLC with the LDR reference number which is 
received from the R-GMLC, and the H-GMLC address. The H-GMLC may itself initiate the cancellation 
procedure, when the UE's privacy profile stored in the H-GMLC or in the PPR was changed. For every 
outstanding Deferred Location Request against that UE, the H-GMLC shall perform or ask the PPR to perform a 
new privacy check based on the updated privacy profile. If the privacy check passes, i.e. the LCS Client is still 
allowed to position the target UE, the handling of the outstanding Deferred Location Request should be 
continued. Otherwise, if the privacy check does not pass, i.e. the Location estimate of the target UE is not 
allowed to be provided to the LCS Client, the H-GMLC shall initiate a cancellation procedure. 

NOTE: The H-GMLC shall know that the UE subscriber's privacy profile has been changed in the PPR when the 
LCS Privacy Profile Update has been sent from PPR to H-GMLC as described in 9.LL2. 

4) The V-GMLC sends the Provide Subscriber Location request to SGSN/MSC, indicating a cancellation of a 
deferred location request and including the LDR reference number specified by the LCS Client in the LCS 
Cancel Service Request and the H-GMLC address received from the H-GMLC. 

5) The SGSN/MSC sends the LCS Area Event Cancellation, including the LDR reference number and the H- 
GMLC address, request to UE. 

6a) The UE cancels the Area event deferred location request and sends the LCS Area Event cancellation ack., with 
no area event information included to VMSC/SGSN. 

6b) While the UE is monitoring for the area event to occur, the UE may cancel or terminate the deferred location 
request for the change of area on its own behalf by sending the LCS Area Event report with the LDR reference 
number, an indication of the cancellation and an appropriate error cause. 

7) The SGSN/MSC sends the cancellation acknowledgement to the V-GMLC in the Provide Subscriber Location 
Ack, with the LDR reference number and the H-GMLC address. 

8) The V-GMLC sends the LCS Cancel Service Response to H-GMLC with the LDR reference number and the H- 
GMLC address. 

9) H-GMLC sends the LCS Cancel Service Response to R-GMLC with the LDR reference number. H-GMLC may 
send the LCS Cancel Service Response to R-GMLC, even if the R-GMLC/LCS client has not requested the 
cancellation, see step 3. 

10) R-GMLC sends the LCS Cancel Service Response to the LCS CHent. 

9.1 .10 Circuit Switclied Post Positioning Notification and Verification 
Procedure 

Figure 9.10 illustrates the post positioning notification and verification procedure. 
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Figure 9.10: CS Post Positioning Notification and Verification Procedure 

1) Common PS and CS MT-LR procedure as described in 9. 1 . 1 . 

2) The GMLC sends a PROVIDE. SUBSCRIBER .LOCATION message to the MSC/MSC server with an 
indication of "notification only". This message carries the UE subscriber's IMSI. For a call related location 
request, the message also carries the LCS client's called party number. For a value added LCS client, the 
message shall carry the client name, the external identity of the LCS client and the Requestor Identity (if that is 
both supported and available). Also the message may carry the type of the LCS client name and also the type of 
the Requestor identity if the requestor identity was included. For a PLMN operator LCS client, the message shall 
carry the internal identity of the LCS client. Moreover the message may also carry the Service Type. If the result 
of the privacy check at H-GMLC/PPR indicated that the codeword shall be sent to the UE user, the message may 
carry also the codeword received from the LCS client. For a PLMN operator LCS client, the message shall carry 
the internal identity of the LCS client. If the Requestor Identity is provided, the GMLC shall send it as separate 
information. In addition, in order to display the requestor identity in case of pre Rel-5 network elements (i.e. 
MSC and/or UE), the requestor identity may be also added to the LCS client name by the GMLC. When the 
Requestor identity is added to the LCS client name the practice described in the Annex D should be followed. 

3) If the UE is in idle mode, the Core Network performs paging, authentication and ciphering. The MSC will page a 
GPRS attached UE either through A/Iu or Gs interface, depending on the presence of the Gs interface. 

4) An LCS Location Notification Invoke message is sent to the target UE indicating a location type of notification 
and verification only, the identity of the LCS client, the Requestor Identity (if that is both supported and 
available) and whether privacy verification is required. Also the message may indicate the type of the LCS client 
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name and also the type of the Requestor identity if the requestor identity was included. Moreover, the message 
may carry also the service type and the codeword.4). 

5) The target UE notifies the UE user of the location request. If privacy verification was requested, the target UE 
indicates to the UE user whether the location report will be allowed or not allowed in the absence of a response 
and waits for the user to grant or withhold permission. The UE then returns an LCS Location Notification Return 
Result to the VMSC/MSC server indicating, if privacy verification was requested, whether permission is granted 
or denied. If the UE user does not respond after a predetermined time period, the VMSC/MSC server shall infer 
a "no response" condition. The VMSC/MSC server shall return an error response to the GMLC if privacy 
verification was requested and either the UE user denies permission or there is no response with the UE 
subscription profile indicating barring of the location request in the absence of a response. 

6) The VMSC/MSC server returns the indication of successful notification and verification result, if it has received 
a LCS Location Notification Return Result indicating that permission is granted. If a LCS Location Notification 
Return Result message indicating that permission is not granted is received, or there is no response, with the 
requested privacy action or the UE subscription profile indicating barring of location in the absence of a 
response, the VMSC/MSC server shall return an error response to the GMLC. The MSC/MSC server may then 
release the Mobility Management connection to the UE, if the UE was previously idle, and the MSC/MSC server 
may record charging information. 

7) Common MT-LR procedure in PS and CS domain as described in 9. 1 . 1 . 
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9.1 .11 Packet Switched Post Positioning Notification and Verification 
Procedure 

Figure 9.11 illustrates the post positioning notification and verification procedure. 
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Figure 9.11: PS Post Positioning Notification and Verification Procedure 

1) Common PS and CS MT-LR procedure as described in 9. 1 . 1 . 

2) The GMLC sends a Provide Subscriber Location message to the SGSN with an indication of "notification only". 
This message carries the UE subscriber's IMSI. For a session related location request, the message also carries 
the APN-Nl to which the user has established the session. For a value added LCS client, the message shall carry 
the client name, the external identity of the LCS client and the Requestor Identity (if that is both supported and 
available), optionally the message may also carry the Service Type. Also the message may carry the type of the 
LCS client name and also the type of the Requestor identity if the requestor identity was included. If the result of 
the privacy check at H-GMLC/PPR indicated that the codeword shall be sent to the UE user, the message may 
carry also the codeword received from the LCS client. For a PLMN operator LCS client, the message shall carry 
the internal identity of the LCS client. If the Requestor Identity is provided, the GMLC shall send it as separate 
information. In addition, in order to display the requestor identity in case of pre Rel-5 network elements (i.e. 
SGSN and/or UE), the requestor identity may be also added to the LCS client name by the GMLC. When the 
Requestor identity is added to the LCS client name the practice described in the Annex D should be followed. 
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3) The SGSN determines a required privacy related action as described in Annex A.3 based on the indicators of 
privacy related action in the PSL message from the GMLC. If the UE is in idle mode, the SGSN performs 
paging. The paging procedure is defined in TS 23.060 [15]. 

4) Security functions may be executed. These procedures are defined in TS 23.060 [15]. 

5) A notification invoke message is sent to the target UE indicating a location type of notification and verification 
only, the identity of the LCS client and the Requestor Identity (if that is both supported and available), whether 
privacy verification is required. Also the message may indicate the type of the LCS client name and also the type 
of the Requestor identity if the requestor identity was included. Moreover, the message may carry also the 
service type and the codeword. 

6) The target UE notifies the UE user of the location request and, if privacy verification was requested, waits for the 
user to grant or withhold permission. The UE then returns a notification result to the SGSN indicating, if privacy 
verification was requested, whether permission is granted or denied. If the UE user does not respond after a 
predetermined time period, the SGSN shall infer a "no response" condition. The SGSN shall return an error 
response to the GMLC if privacy verification was requested and either the UE user denies permission or there is 
no response with the UE subscription profile indicating barring of the location request. 

7) The SGSN returns the indication of successful notification and verification result, if it has received a LCS 
Location Notification Return Result indicating that permission is granted. If a LCS Location Notification Return 
Result message indicating that permission is not granted is received, or there is no response, with the requested 
privacy action or the UE subscription profile indicating barring of location, the SGSN shall return an error 
response to the GMLC. 

8) Common MT-LR procedure in PS and CS domain as described in 9. 1 . 1 . 

9.1 .12 Deferred Location Request Procedure for the Periodic Location 
Event 

This clause describes the procedures for a Deferred Location Request where a Location Report is returned to the 
network each time the periodic reporting event occurs within the UE. 

9.1 .1 2.1 Instigation of an MT-LR Request for Periodic Location 
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Figure 9.12: Deferred MT-LR Initiation Procedure for Periodic Location 
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1) The LCS Service Request contains the periodic location request information, such as time interval between 
successive location reports and total number of reports. 

2) LCS service request handling between GMLCs as described in clause 9.1.1. The information received by the R- 
GMLC is transferred to the H-GMLC. The R-GMLC also indicates whether MO-LR Short Circuit is allowed. 
The H-GMLC assigns a LDR reference number to this LCS Service Request and may include a list of PLMNs 
and possibly associated radio access technologies (e.g. GSM, UMTS), either prioritized or non-prioritized, in 
which subsequent MO-LR TTTP requests must be made by the UE (according to the procedure in clause 
9.1.12.2) and an indication for each PLMN (and possibly associated radio access technology) as to whether the 
PLMN supports periodic location in the RAN. If no list is included by the H-GMLC, subsequent MO-LR TTTP 
requests are restricted to the current serving PLMN only. The H-GMLC then transfers the information to the V- 
GMLC, including the LDR reference number, any reporting PLMN list and the H-GMLC address. 

NOTE 1 : Any preference for using MO-LR Short Circuit needs to consider the list of PLMNs in which subsequent 
MO-LR TTTP requests will be made (if this was included by the H-GMLC) since this agreement applies 
to all of these PLMNs. 

3) The V-GMLC conveys the periodic location request to MSC/SGSN in the Provide Subscriber Location request 
including the LDR reference number, any reporting PLMN list and the H-GMLC address in the request, as well 
as an indication of whether MO-LR Short Circuit is permitted. 

4) The MSC/SGSN verifies the UE capabilities with regard to the support of location service related call 
independent supplementary services (e.g. notification for LCS). If either the UE does not support any location 
service related call independent supplementary service or the MSC/SGSN does not support the deferred location 
request for the periodic location event (for temporary or permanent reasons), a Provide Subscriber Location 
return error shall be returned with a suitable cause in step 7. 

If the UE is in idle mode, the core network performs paging, authentication and ciphering. If privacy 
notification/verification is requested, the MSC/SGSN sends an LCS Location Notification Invoke message to the 
target UE with a location type indicating activation of a deferred location request, a deferred location event type 
indicating periodic location and an indication as to whether privacy verification is required. LCS Location 
Notification is further specified in clauses 9.1.2 and 9.1.6. If privacy verification was requested, the UE returns 
an LCS Location Notification Return Result to the MSC/SGSN indicating whether permission is granted or 
denied. If a previous deferred location request is ongoing in the UE and the MSC/SGSN proceeds with the 
current deferred request, the UE may return an LCS Location Notification Return Error response to the 
MSC/SGSN indicating that the new request cannot be supported. 

NOTE 2: There is no UE capability information directly indicating support of a periodic deferred location request. 
However, if the UE supports at least one location service related call independent supplementary service 
(such as notification for LCS), the MSC/SGSN can assume support for a periodic deferred location 
request and attempt to request it in step 5. If the UE does not recognize this request, it may return a 
Facility Rejected indication in step 6 (as defined in TS 24.008 [24]) to the MSC/SGSN. The return of at 
least this minimal indication of non-support (as opposed to the UE ignoring the request and sending back 
nothing) is ensured by support of at least one location service related call independent supplementary 
service. 

5) The MSC/SGSN sends an LCS Periodic Location Invoke to the UE containing the periodic location related 
parameters (reporting interval and total number of reports) and other relevant information (QoS, LCS Client 
External ID, H-GMLC address, LDR reference number, any reporting PLMN list and use of MO-LR Short 

Circuit). 

6) If the LCS Periodic Location Invoke is successfully received by the UE and the UE supports the periodic 
location according to the request received in step 5, the UE sends an acknowledgement to MSC/SGSN including 
the MO-LR Short Circuit indication if received in step 5. If the MO-LR Short Circuit indication is received in 
step 5 and the UE does not support MO-LR Short Circuit (for temporary or permanent reasons), the UE sends 
the LCS Periodic Location Invoke Ack without the MO-LR Short Circuit indication indicating to the 
MSC/SGSN that MO-LR Short Circuit will not be used. If a previous deferred location request is still ongoing in 
the UE, the UE may return an LCS Periodic Location Return Error response to the MSC/SGSN indicating that 
the new request cannot be supported. 

7) If either the MSC/SGSN or the UE does not support the periodic location request (for temporary or permanent 
reasons), a Provide Subscriber Location return error shall be returned to the V-GMLC with a suitable error 
cause. 

If both of the MSC/SGSN and UE supports the periodic location request, a Provide Subscriber Location Ack. 
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shall be returned to the V-GMLC. The MSC/SGSN shall include an MO-LR Short Circuit indication in the 
response to the V-GMLC, if the use of MO-LR Short Circuit was requested and accepted by the UE in step 6. 

8) to 10) The V-GMLC returns the LCS Service Response via H-GMLC and R-GMLC to the LCS Client to notify 
whether the periodic location request was successfully accepted or not. When the H-GMLC returns the LCS 
Service Response to the R-GMLC, the LDR reference number assigned by the H-GMLC shall be included, and 
the R GMLC may transfer the LDR reference number to the LCS Client in the LCS Service Response. 

NOTE 3: If the R-GMLC receives an error response in step 9 indicating that the MT-LR request for periodic 

location cannot be supported (for temporary or permanent reasons), the R-GMLC may invoke periodic 
location using the common MT-LR procedure defined in clause 9.1.1. 

9.1 .1 2.2 Reporting of Periodic Location 

Once the periodic location reporting has been successfully instigated using the procedure in figure 9.12 (or 9.8a in case 
the UE subscriber or an application in the UE is the instigator), the UE is responsible for sending location estimates 
periodically to the LCS Client using MO-LR TTTP procedure illustrated in figure 9.13 below. This procedure begins 
immediately or, in the case of MO-LR short circuit, almost immediately after the procedure in figure 9.12 (or 9.8a) and 
continues until the specified number of reports for this request is attained or the procedure is cancelled by the UE, 
R-GMLC or H-GMLC using the procedure specified in clause 9.1.12.3. 
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Figure 9.13: Reporting of Periodic Location 

1) to 2) If the UE is in idle mode, the UE requests a radio connection setup and sends a CM Service Request 
indicating a request for call independent supplementary service to the VMSC/MSC server via RAN (CS 
domain). If the UE is in dedicated mode, the UE sends a CM Service Request on the already established radio 
connection. The VMSC/MSC server instigates authentication and ciphering if the UE was in idle mode or returns 
a CM Service Accept if the UE was in dedicated mode. 

For PS domain, in UMTS, if the UE is in idle mode, the UE requests a PS signalling connection and sends a 
Service Request indicating signalling to the SGSN via RAN. If the UE already has PS signalling connection, the 
UE does not need to send the Service Request. Security functions may be executed. These procedures are 
described in TS 23.060 [15]. In GSM this signalling step is not needed. 
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3) The UE sends an LCS MO-LR Invoke to the VMSC/MSC Server (CS domain) or to the SGSN (PS domain) for 
a transfer of the location estimate to a third party LCS cHent. This message includes the identity of the LCS 
client and the H-GMLC address received by the UE during execution of the procedure described in 

clause 9.1.12.1 (or clause 9.2.3). 

The LCS MO-LR Invoke also includes the LDR Reference Number. The presence of the LDR Reference 

Number indicates that the transfer and its attributes (e.g. use of MO-LR Short Circuit) have been previously 

authorized by the R-GMLC, H-GMLC and V-GMLC, using the procedure described in clause 9.1.12.1 (or 

clause 9.2.3). 

This message also includes a location estimate if MO-LR Short Circuit was requested and has been 

acknowledged by the UE. If MO-LR Short Circuit has been acknowledged and the UE was not able to obtain a 

location estimate, the LCS MO-LR Invoke shall still be sent when the reporting event occurs indicating that no 

location estimate is available. 

If MO-LR Short circuit has not been agreed or was not requested, the LCS MO-LR Invoke message does not 

include any location estimate or error indication, but includes QoS information and optional periodic location 

information (reporting interval and number of reports), as well as an optional request for location update 

notification (see steps 13 and 14). 

4) to 6) If MO-LR Short Circuit is not used (i.e. no location estimate or no error indicating unavailability of a 

location estimate is included in step 3), the MSC/SGSN obtains a location estimate by sending a Location 
Request to RAN associated with the target UE in step 4. The Location Request includes the LCS QoS. If 
supported by the serving RAN and included by the UE in step 3, the Location Request can include periodic 
location information (e.g. reporting interval and number of reports). In step 5, RAN determines the positioning 
method and instigates the particular message sequence for this method, as specified in UTRAN Stage 2, 
TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. When a location estimate best satisfying the requested QoS 
has been obtained, RAN returns it to the MSC/SGSN in a Location Report message in step 6. 

7) If a location estimate has been received from the UE in step 3 (i.e. use of MO-LR Short Circuit) or was 
successfully obtained in step (6), the MSC/SGSN sends a MAP Subscriber Location Report to its associated V- 
GMLC with an indication of the periodic event occurrence, the LDR reference number, the H-GMLC address 
and may also include the indication whether the obtained location estimate satisfies the requested accuracy or not 
(provided that this indication is obtained from RAN or the UE with the location estimate). If no location estimate 
was obtained in step 3 or 6 (e.g. positioning failure or time out), a report indicating this shall be returned. 

8) The V-GMLC sends an acknowledgement to the MSC/SGSN and the MSC/SGSN may record charging 
information. 

9) The V-GMLC sends an LCS Service Response to the H-GMLC with an indication of the periodic event 
occurrence, the LDR reference number and the location estimate if this was successfully obtained. If the location 
estimate could not be obtained, the V-GMLC sends the LCS Service Response without the location estimate. 
The LDR reference number will be used by the H-GMLC to identify the source of the original periodic location 
request. The V-GMLC may record charging information. 

1 0) The H-GMLC may perform a privacy check as described in clause 9.1.1. 

1 l)The H-GMLC sends an LCS Service Response to the R-GMLC with an indication of the periodic event 

occurrence, the LDR reference number and the location estimate if this was successfully obtained. If the location 
estimate could not be obtained, the H-GMLC sends the LCS Service Response without the location estimate. If 
this is the final location report, the periodic location request shall be completed in the H-GMLC. The H-GMLC 
may record charging information. 

12) The location information is passed to the LCS Client. If this is the final location report, the periodic location 
request shall be completed in the R-GMLC. The R-GMLC may record charging information. 

13) to 14) If periodic reporting in the RAN was instigated in step 4 and location update notification was requested in 
step 3, an LCS Location Update is sent to the UE to indicate successful transfer of the first location estimate (or 
possibly transfer of a location failure report) towards the LCS Client. The UE acknowledges this. The UE may 
employ the LCS Location Update ack. to cancel the procedure (see Note 2). 

15) to 24) If periodic reporting in the RAN was instigated in step 4, RAN obtains a new location estimate in step 15 
and transfers this to the MSC/SGSN in step 16 after the reporting interval has transpired. The MSC/SGSN 
transfers the location estimate to the LCS client in steps 17 to 22. Steps 17 to 22 are as in steps 7 to 12. An LCS 
Location Update is then sent to the UE in step 23 and acknowledged in step 24 if requested in step 3. Steps 23 
and 24 are as in steps 13 and 14. Steps 15-24 are repeated at the periodic location interval (as the RAN provides 
each new location estimate to the MSC/SGSN) until the number of reports is attained, or until there is a request 
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from the RAN to hand the UE over to a different MSC/SGSN. Following transfer of the final location estimate to 
the LCS Client, the transfer and acknowledgment of an LCS Location Update in steps 23 and 24, if requested in 
step 3, could be omitted as an implementation option. 

25) The MSC/SGSN returns an LCS MO-LR Return Result to the UE indicating that the location estimate (or 
location estimates in case of periodic reporting in RAN was instigated at step 4 has been successfully transferred 
to the LCS client or not. 

26) The MSC/SGSN may release the CM, MM or GMM and radio connection to the UE, if the UE was previously 
idle. 

The UE is responsible for restarting the procedure at step 1 or 3 if the total number of location reports has not yet 
been reached. In the case of restarting at step 3, the CM, MM/GMM and radio connections would not be 
released. 

NOTE 1 : In case of periodic reporting in the RAN is used, the LCS MO-LR TTTP invoke request sent by the UE in 
step 3 could include, besides the periodic reporting interval, a number of reports less than or equal to the 
remaining number of reports for the whole procedure. When a smaller number of reports was requested, 
the target UE would be responsible for reissuing further MO-LR requests, after periodic reporting from 
the RAN was completed, until the overall number of reports was attained. 

NOTE 2: After each location estimate (or possibly location failure report) has been transferred to the LCS client 
(e.g. after step 12, 22), the MSC/SGSN sends an LCS Location Update Invoke message to the UE 
indicating that the location estimate (or possibly location failure report) has been successfully transferred 
if this was requested by the UE in step 3. The UE acknowledges the receipt of the LCS Location Update 
Invoke message and a cancellation of location could be included if the UE subscriber wishes to cancel the 
periodic location procedure at that point. In the event that the UE cancels the procedure, the MSC/SGSN 
shall notify the V-GMLC, H-GMLC, R-GMLC and LCS Client using the procedure in clause 9.L12.4. 

If the UE moves out of coverage of the PLMN(s) in which the location reports are allowed or if a conflict 
with the PLMNs preferred by the UE for other services prevents access to the PLMN(s) for periodic 
location, the UE terminates the procedure and stops sending LCS MO-LR Invoke. The UE may determine 
the need for termination if it is unable to instigate an MO-LR TTTP request for some period of time (e.g. 
some multiple of the required periodic location interval). 

If any LCS MO-LR Invoke TTTP request is rejected by the current serving PLMN with a cause indicating 
that the procedure cannot be supported (for temporary or permanent reasons) - e.g. MO-LR Short Circuit 
was initially agreed, but can no longer be supported or cannot be supported in the new PLMN - and the 
UE is unable to instigate the procedure in any other PLMN allowed when the procedure was originally 
started, the UE terminates the procedure and stops sending LCS MO-LR Invoke TTTP requests. 

9.1 .1 2.3 LCS Client cancellation of a Deferred Location Request - Periodic Location 
Event 

Figure 9. 14 illustrates the procedure for cancelling the Deferred Location Request for the periodic location event when 
cancellation is requested by the LCS Client. 
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Figure 9.14: LCS Client cancellation of a Deferred IVIT-LR for Periodic Location 

1) The LCS Client requests the cancellation of a previously requested Deferred Location Request. The LDR 
reference number that was included in the previous LCS Service Response sent by the R-GMLC shall be 
included in the request to indicate which outstanding LDR should be cancelled. 

2) The R-GMLC sends the cancellation request to H-GMLC, including the LDR reference number. The R-GMLC 
may itself initiate the cancellation for some other reason, e.g. whenever the R-GMLC infers from the absence of 
periodic location reports that the service may have been terminated. 

3) The H-GMLC may send a SEND_ROUTING_INFO_FOR_LCS message to the home HLR/HSS of the UE with 
the IMSI or MSISDN of this UE. This may be needed if the UE may no longer be served by the original 
V-PLMN or by the original SGSN or VMSC/MSC server. 

4) The HLR/HSS returns the current SGSN and/or VMSC/MSC server for the UE and the V-GMLC address. 

5) The H-GMLC forwards the LCS Cancel Service Request to V-GMLC with the LDR reference number which is 
received from the R-GMLC, the H-GMLC address and the SGSN or VMSC/MSC server address (e.g. received 
from the HLR/HSS). The H-GMLC may itself initiate the cancellation procedure, when the UE's privacy profile 
stored in the H-GMLC or in the PPR was changed. For every outstanding Deferred Location Request against that 
UE, the H-GMLC shall perform or ask the PPR to perform a new privacy check based on the updated privacy 
profile. If the new privacy check passes, i.e. the LCS Client is still allowed to position the target UE, the 
handling of the outstanding Deferred Location Request should be continued. Otherwise, if the new privacy check 
does not pass, i.e. the location estimate of the target UE is not allowed to be provided to the LCS Client, the H- 
GMLC shall initiate a cancellation procedure. If the H-GMLC cannot complete the new privacy check (e.g., 
because it requires information, such as UE location, not currently available to the H-GMLC), then the H-GMLC 
may initiate a cancellation procedure according to H-PLMN privacy policy. 

NOTE: The H-GMLC shall know that the UE subscriber's privacy profile has been changed in the PPR when the 
LCS Privacy Profile Update has been sent from PPR to H-GMLC as described in clause 9.LL2. 
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6) The V-GMLC sends the Provide Subscriber Location request to MSC/SGSN, indicating a cancellation of a 
deferred location request and including the LDR reference number specified by the LCS Client in the LCS 
Cancel Service Request and the H-GMLC address received from the H-GMLC. The V-GMLC shall transfer the 
location cancellation even when the V-GMLC was not involved in establishing the periodic location request - 
e.g. if the target UE is now served by another V-PLMN. 

7) The MSC/SGSN sends the LCS Periodic Location Cancellation request, including the LDR reference number 
and H-GMLC address, to the UE. If the periodic reporting is via the serving RAN as described in step 4 of 
figure 9.13, the periodic location cancellation request is also sent to RAN. 

8) The UE stops the periodic location reporting and returns the LCS Periodic Location cancellation ack. to the 
MSC/SGSN. Return of an LCS Periodic Location cancellation ack. shall apply even when the UE has no 
knowledge of the periodic location procedure being cancelled (e.g. UE was powered off during the procedure). 

9) The MSC/SGSN sends the cancellation acknowledgement to the V-GMLC in the Provide Subscriber Location 
Ack, with the LDR reference number and the H-GMLC address. 

10) The V-GMLC sends the LCS Cancel Service Response to H-GMLC with the LDR reference number and the 
H-GMLC address. 

1 1) H-GMLC sends the LCS Cancel Service Response to R-GMLC with the LDR reference number. 
12)R-GMLC sends the LCS Cancel Service Response to the LCS Client. 

9.1 .1 2.4 UE cancellation of a Deferred Location Request - Periodic Location Event 

Figure 9.15 illustrates the procedure for cancelling the Deferred Location Request for the periodic location event when 
cancellation is requested by the UE. If a network entity (e.g. H-GMLC, V-GMLC, SGSN/MSC) cancels the Deferred 
Location Request, the procedure in clause 9.1.12.3 for LCS Client cancellation shall be used to cancel towards the UE 
and the procedure in this clause shall be used to cancel towards the LCS Client. 
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Figure 9.15: UE cancellation of a Deferred MT-LR for Periodic Location 

1) to 2) If the UE is in idle mode, the UE requests a radio connection setup and sends a CM Service Request 
indicating a request for call independent supplementary service to the VMSC/MSC server via RAN (CS 
domain). If the UE is in dedicated mode, the UE sends a CM Service Request on the already established radio 
connection. The VMSC/MSC server instigates authentication and ciphering if the UE was in idle mode or returns 
a CM Service Accept if the UE was in dedicated mode. 

For PS domain, in UMTS, if the UE is in idle mode, the UE requests a PS signalling connection and sends a 
Service Request indicating signalling to the SGSN via RAN. If the UE already has PS signalling connection, the 
UE does not need to send the Service Request. Security functions may be executed. These procedures are 
described in TS 23.060 [15]. In GSM this signalling step is not needed. 

3) The UE sends an LCS MO-LR Invoke to the VMSC/MSC Server (CS domain) or to the SGSN (PS domain) for 
cancellation of a transfer of location to a third party LCS client. This message includes the identity of the LCS 
client, the H-GMLC address, a termination cause (e.g. subscriber terminates the procedure) and the LDR 
Reference Number. The presence of the LDR Reference Number indicates that the cancellation is for a 
previously authorized periodic location request. 

4) to 7) The cancellation request shall be transferred in succession from the MSC/SGSN to the V-GMLC, H-GMLC, 

R-GMLC serving the LCS client and finally may be transferred to the LCS client (e.g. if the LCS Client 
originated the periodic location request or was informed of a periodic location request originated by the UE as in 
clause 9.2.3). 

8) to 11) The response transferred back to the MSC/SGSN acknowledges the cancellation. 

12) The MSC/SGSN returns the acknowledgment to the UE in a LCS MO-LR Return Result message. 

13) The UE may instigate release of the CM, MM/GMM and radio connections. 
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9.1.13 IW-MT-LR Procedure 

Figure 9.16 describes the IW-MT-LR procedure. 
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Figure 9.16: IW-MT-LR in l-WLAN 

Even though figure 9.16 does not specify the specific services with IW-MT-LR, this flow can be 
applicable for both immediate and triggered services (e.g. periodic or change of area event case). 



1. A WLAN UE selects a WLAN AN and establishes the WLAN connection and is authenticated in I-WLAN. The 
WLAN AN may send the current location of WLAN AN to the WLAN UE. The WLAN AN may send its 
location to the AAA. The tunnel may be established with between WLAN UE and one of PDGs in PLMN. 

2. An external LCS client sends the LCS request to the GMLC. An external LCS client requests the current 
location, e.g. immediate location request, from a GMLC. The LCS Client may also request a triggered location 
request, e.g. periodic or change of area event. The GMLC verifies the identity of the LCS client and its 
subscription to the LCS service requested and derives the MSISDN or IMSl or pseudonym of the target UE to be 
located and the LCS QoS from either subscription data or data supplied by the LCS client. 

The LCS request may carry also the Service Identity and the Codeword. The GMLC may verify that the Service 
Identity received in the LCS request matches one of the service identities allowed for the LCS client. If the 
service identity does not match one of the service identities for the LCS client, the GMLC shall reject the LCS 
request. Otherwise, the GMLC can map the received service identity in a corresponding service type. 

If the location request is originated by a Requestor, the Requestor Identity may be added to the LCS service 
request. The LCS client should authenticate the Requestor Identity but this is outside the scope of this 
specification. The LCS service request may also contain the type of the Requestor identity if the requestor 
identity was included. 

The GMLC performs privacy check on the basis of the UE user's privacy profile stored in the GMLC or PPR. 
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3. Steps 3 and 4 may be skipped if the GMLC already has the address of the AAA server. Steps 3 to 6 may be 
skipped if the GMLC has alternative access to the UE's IP address (e.g. using dynamic DNS or from a previous 
interaction with the UE) or is able to instigate step 7 without knowing this address (e.g. using MT-SMS or WAP 
Push in the case of SUPL). GMLC requests the address of AAA server and WLAN UE capability to the HSS. In 
this case, the capability information of the WLAN UE refers to capability information of the terminal relevant to 
positioning such as whether the terminal supports the OMA SUPL (OMA AD SUPL [38], OMA TS ULP [39]) 
or whether it supports another location procedures. 

4. HSS returns the address of AAA server of the target WLAN UE and the capability of the WLAN UE to GMLC. 

5. If the target WLAN UE supports the OMA SUPL, GMLC queries AAA to obtain the address of WLAN UE. 
GMLC may request the location of WLAN UE. 

6. If its location is available and the quality of position meets the LCS QoS requested by GMLC, then AAA 
responds with available location information of the WLAN UE to the GMLC. Otherwise, GMLC retrieves the 
address of WLAN UE from AAA. If there is no tunnel is available between the PDG and the WLAN UE, the 
AAA will return an indication that UE is not reachable. 

7. GMLC initiates positioning procedure. This shall use SUPL procedures based on OMA SUPL 

(OMA AD SUPL [38], OMA TS ULP [39]). If the tunnel between the WLAN UE and the PDG is available and 
the GMLC has obtained the UE IP address, GMLC generates an SUPL initiation message, and transmits it to the 
WLAN UE by using the address of WLAN UE over available IP connection between the WLAN UE and the 
PDG. If the tunnel between the WLAN UE and the PDG is not available or if the GMLC did not obtain the UE 
IP address, GMLC sends an SUPL initiation message using the UE IP address if available or by other means 
(e.g. MT-SMS or WAP Push). 

8. The location information obtained will be transferred to external LCS client. 

NOTE 2: The GMLC may, as an implementation option, cache the results received in step 4 and/or step 6 in order 
to avoid further queries when a location request is received for the same target UE at a later time and the 
AAA server address and/or WLAN UE address, respectively, has not changed. 

9.1.14 IW-MT-LR Procedure without HLR/HSS or AAA Query 

Figure 9.17 illustrates current or last known location requests for an emergency services call, where an emergency 
services client (i.e. a Public Safety Answering Point) requests updated location information for the target UE. In order 
to support location of emergency call s from UlCC-less terminals, TS 23.167 [36a] specifies that the IMS core shall 
push information identifying the terminal to the PS AP and GMLC during establishment of the emergency call. 

NOTE 1 : In some regions, based on regional specifications, the GMLC may use correlation information that was 
previously provided to it by the IMS Core to identify the target UE. 

The IMS core also sends the correlation information to the PSAP during the call establishment as described in 
TS 23.167 [36a]. Using the correlation key the PSAP may request the initial or updated location information from the 
GMLC. The management of this regional correlation information (e.g. ESQK in North America) and support of the Le 
interface to the external LCS Client may be handled by a separate functional entity from the GMLC, e.g. a RDF as 
defined in TS 23.167 [36a]. 
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Figure 9.17: IW-MT-LR without an HLR/HSS or AAA Query 

1 . The WLAN UE selects a WLAN AN and establishes the WLAN connection and may be authenticated in I- 
WLAN. The tunnel is established between the WLAN UE and a PDG in PLMN. 

2. The WLAN UE establishes an emergency services call as described in TS 23.167 [36a]. The UE determines its 
own location if possible. The UE may include the identifier of access node (e.g., MAC address of the AP), if 
available, as location identifier in the session request and possibly other readily available location information, 
e.g. GPS based coordinates or the street address of the UE or the AP as provided by the user of the UE. If the UE 
is not able to determine its own location, the UE may, if capable, request the location information from the 
IP-CAN or SLP. The case when the UE requests its own location information or enhanced location information 
from the SLP using OMA-SUPL is described in clause 9.2.5. The IP-CAN may return a representation of the 
location information to the UE. During this step, the IMS core may push the WLAN UE's identification and the 
location information provided by the UE to the LRF (GMLC) along with correlation information, if applicable. 
The GMLC may record this information but in some regions only for the duration of the call as the case may be. 
The correlation information may be regionally specific (e.g. as is the case for support of location for an 
emergency call in the CS domain in clause 9.1.3). The IMS core shall also send the correlation information to the 
PSAP/ emergency centre during the call establishment as specified in TS 23.167 [36a]. 

NOTE 2: The mechanism used by the UE to obtain location information from the I- WLAN IP -CAN is out of scope. 
One method that could be used is the mechanism defined by IEEE 802.1 Ik Task Group for carrying 
location information (per RFC 3825) from one IEEE 802.1 1 station/ AP to another IEEE 802.1 1 
station/ AP. 

3. An external LCS client associated with the emergency centre PSAP sends a location request to the GMLC for 
the initial location or an updated location for the WLAN UE. The request may include the address and the 
identification of the WLAN UE and in some regions may include correlation information that enables the GMLC 
to associate the request with the information stored in step 2. 

4. If initial location was requested the procedure continues from step 5. If updated location was requested the 
GMLC initiates a positioning procedure where either the UE or GMLC determines the position of the UE. 
GMLC/SLP shall request the UE to establish a so called user plane connection with the GMLC/SLP and use the 
OMA SUPL mechanism specified by OMA (OMA AD SUPL [38], OMA TS ULP [39]) to transport location 
related assistance data and location information between the UE and GMLC/SLP. The UE may send the 
identifier of the access node (e.g. MAC address of the AP) to the GMLC and GMLC, possibly using an external 
database, maps this location identifier to the corresponding geographical information, e.g. coordinates or street 
address. GMLC may return this geographical information to the UE. 

NOTE 3: The location information obtained based on the mapping of an identifier of access node (e.g. MAC 

address of the AP) to location information stored in a database may not be correct, e.g. the location of the 
AP might be changed without any updates to the database. 
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5. GMLC sends the initial location information, if so requested, or the updated location information obtained in 
step 4 to the external LCS client. 

9.1 .15 EPC Mobile Terminating Location Request (EPC-MT-LR) 

Figure 9.18 illustrates the general network positioning for LCS clients external to the PLMN for EPC services. In this 
scenario, it is assumed that the target UE is identified using an MSISDN or IMSI. 
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Figure 9.18: General Network Positioning for EPC-MT-LR 

9.1.15.1 Location Preparation Procedure 

1) Common PS and CS MT-LR procedure as described in clause 9.1.1. 

2) GMLC sends a Provide Subscriber Location message to the MME indicated by the HLR/HSS. This message 
carries the type of location information requested (e.g. current location and optionally, velocity), the UE 
subscriber's IMSI, LCS QoS information (e.g. accuracy, response time) and an indication of whether the LCS 
client has the override capability. For a session related location request, the message also carries the APN-NI to 
which the UE user has established the session. For a value added LCS client, the message shall carry the client 
name, the external identity of the LCS client and the Requestor Identity (if that is both supported and available), 
optionally the message may also carry the Service Type. Also the message may carry the type of the LCS client 
name and also the type of the Requestor identity if the requestor identity was included. If the result of the privacy 
check at H-GMLC/PPR indicated that the codeword shall be sent to the UE user, the message may carry also the 
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codeword received from the LCS client. For a PLMN operator LCS client, the message shall carry the internal 
identity of the LCS client. If the Requestor Identity is provided, the GMLC shall send it as separate information. 
The message also shall carry the indicators of privacy related action which is described in clause 9.5.4, if it is 
provided by H-GMLC. 

3) If the GMLC is located in another PLMN or another country, the MME first authenticates that a location request 
is allowed from this PLMN or from this country. If not, an error response is returned. Secondly the MME checks 
if the UE is detached or suspended and in either such case an error response is returned. If the PSL message from 
the GMLC includes the indicators of privacy related action, the MME determines a required privacy related 
action as described in clause A. 3. If the UE is in ECM-IDLE state, the MME performs a network triggered 
service request as defined in TS 23.401 [41] in order to establish a signalling connection with the UE and assign 
a specific eNodeB. 

4) If the location request comes from a value added LCS client and the indicators of privacy related action indicates 
that the UE must either be notified or notified with privacy verification and the UE supports notification of LCS, 
a notification invoke message is sent to the target UE indicating the type of location request from the LCS Client 
(e.g. current location or "current or last known location") and the identity of the LCS client and the Requestor 
Identity (if that is both supported and available), whether privacy verification is required. Also the message may 
indicate the type of the LCS client name and also the type of the Requestor identity if the requestor identity was 
included. Moreover, the message may carry also the service type and the codeword. Optionally, the MME may 
after sending the NAS Location Notification Invoke message continue in parallel the location process, i.e. 
continue to step 6 without waiting for a LCS Location Notification Return Result message in step 5. 

5) The target UE notifies the UE user of the location request and, if privacy verification was requested, waits for the 
user to grant or withhold permission. The UE then returns a notification result to the MME indicating, if privacy 
verification was requested, whether permission is granted or denied. Optionally, this message can be returned 
some time after step 4, but before step 9. If the UE user does not respond after a predetermined time period, the 
MME shall infer a "no response" condition. The MME shall return an error response to the GMLC if privacy 
verification was requested and either the UE user denies permission or there is no response with the UE privacy 
profile received from the GMLC indicating barring of the location request. 

6) The MME selects a E-SMLC as described in clause 6.3. 13 and sends a Location Request message to the selected 
E-SMLC. Once an MME has selected an E-SMLC it must continue to use that E-SMLC for the duration of the 
session. The Location Request includes the type of location information requested, the requested QoS, identity of 
serving cell, UE location capabilities and, if available, the Service Type. If this step is performed after the MME 
receives the NAS Location Notification Return Result in step 5, the Location Request message contains the 
identity of the serving cell obtained from the S 1 -AP message that carries the NAS Location Notification Return 
Result. 

NOTE: If the UE is in connected mode and step 6 is performed without receiving NAS Location Notification 
Return Result in step 5, the MME may not have the most current serving cell identity if there was an 
intra-eNodeB handover. 

9.1 .1 5.2 Positioning IVIeasurement Establishment Procedure 

7) If the requested location information and the location accuracy within the QoS can be satisfied based on 
parameters received from the MME, e.g. cell identity, the E-SMLC may send a Location Response immediately. 
Otherwise, the E-SMLC determines the positioning method and instigates the particular message sequence for 
this method as described in clause 9.3a. If the position method returns position measurements, the E-SMLC uses 
them to compute a location estimate. If there has been a failure to obtain position measurements, the E-SMLC 
may use the current cell identity to derive an approximate location estimate. If an already computed location 
estimate is returned for an UE based position method, the E-SMLC may verify consistency with the current cell. 
If the location estimate so obtained does not satisfy the requested accuracy and sufficient response time still 
remains, the E-SMLC may instigate a further location attempt using the same or a different position method. If a 
vertical location co ordinate is requested but the E-SMLC can only obtain horizontal co-ordinates, these may be 
returned. 

9.1 .1 5.3 Location Calculation and Release Procedure 

8) When location information best satisfying the requested location type and QoS has been obtained, the E-SMLC 
returns it to the MME in a Location Response message. E-SMLC shall in its response include an indication 
whether the obtained location estimate satisfies the requested accuracy or not. The information of the positioning 
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method used may be returned with the location information. If a location estimate could not be obtained, the E- 
SMLC returns a Location Response message containing a failure cause and no location estimate. 

9) The MME returns the location information, its age and obtained accuracy indication to the GMLC, if the MME 
has not initiated the Privacy Verification process in step 4. If step 4 has been performed for privacy verification, 
the MME returns the location information only, if it has received a NAS Location Notification Return Result 
indicating that permission is granted. In these cases, the information about the positioning method used may be 
sent with the location information. If a NAS Location Notification Return Result message indicating that 
permission is not granted is received, or there is no response, with the requested privacy action or the UE 
subscription profile indicating barring of location, the MME shall return an error response to the GMLC. If the 
MME did not return a successful location estimate, but the privacy checks were successfully executed, the MME 
may return the last known location of the target UE if this is known and the LCS client is requesting the current 
or last known location. The MME may record charging information. 

10)Common MT-LR procedure in PS and CS domain as described in clause 9.LL 

9.1.16 EPC-MT-LR without HLR Query 

Figure 9.19 illustrates current or last known location requests for an emergency services call, where an emergency 
services client (i.e., a Public Safety Answering Point) identifies the target UE and the serving LRF using correlation 
information that was previously provided to it by the IMS Core. The signalling used to provide the correlation 
information to the PSAP is defined in TS 23.167 [36a]. The correlation information may be used by the LRF to retrieve 
other information previously provided to it by the IMS Core as per TS 23.167 [36a] and/or MME as described in 
clause 9.1.17. This allows the V GMLC associated with the LRF to request location from the MME without first 
querying the home HLR of the target UE. This scenario therefore supports location of emergency calls from roamers or 
SIM-less emergency calls, or non-registered (U)SIM emergency calls, and requires that the initial location, as well as 
UE and MME identifying information had been pushed to the GMLC/LRF as per clause 9. 1 . 17 or as per 
TS 23.167 [36a]. 
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Figure 9.19: Positioning for a Emergency Services EPC-IUIT-LR without HLR Query 

1) Same as step 1 in figure 9.1 but with the LCS client (PSAP) identifying first the target UE and the serving LRF 
by previously supplied correlation information for the emergency call. 

2) The LRF/GMLC may determine the MME by associating the correlation information received from the PSAP 
with other information received previously from the MME using an EPC NI LR as in clause 9.1.17 and/or from 
the IMS core as in TS 23.167 [36a]. The Provide Subscriber Location message sent to the MME carries, if 
available, the MSISDN or the IMSI and, if available, the IMEI for the target UE, as well as the required QoS and 
an indication of a location request from an emergency services client. The MME identifies the target UE using 
the IMSI, MSISDN and/or the IMEI. In case of a SIM-less emergency call, or non-registered (U)SIM emergency 
call, the IMEI shall be always sent. 

3) The MME sends a Location Request to the E-SMLC, as for a normal EPC MT LR. 
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4) E-SMLC performs positioning as for a normal EPC MT LR. 

5) E-SMLC returns a location estimate to the MME as for a normal EPC MT LR. 

6) The MME returns the location information, its age and obtained accuracy indication to the LRF/GMLC. The 
information about the positioning method used may be sent with the location information. If the E-SMLC did not 
return a successful location estimate, the MME may return the last known location of the target UE if this is 
known and the LCS client is requesting the current or last known location. 

7) The LRF sends the location service response to the LCS client (PSAP). 

NOTE: The MME determined by the LRF/GMLC in step 2 must be the current MME for the UE. In the event of 
handover to a new MME, this may require updating of the GMLC using the EPC NI LR procedure in 
clause 9.1.17. 

9.1 .17 EPC Network Induced Location Request (EPC-NI-LR) 

At any time after detecting an emergency situation (i.e. after emergency Attach, UE requested emergency PDN 
Connectivity), the MME may initiate the EPC Network Induced Location Request (EPC NI LR) procedure. The 
procedure is illustrated in figure 9.20. 
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Figure 9.20: Network Induced Location Request for EPC 

1) For the emergency call invocation from the user, the UE performs emergency attach if not attached or requests 
emergency PDN connection if already normal attached. As part of the Attach procedure, the UE support of LPP 
indication is provided by the UE to the MME. When an emergency attach or emergency PDN connection 
establishment is detected, the MME initiates the EPC-NI-LR procedure. 

2) The MME selects a E-SMLC as described in clause 6.3.13 and sends a Location Request message to the selected 
E-SMLC. Once an MME has selected an E-SMLC it must continue to use that E-SMLC for the duration of the 
session. The Location Request includes the type of location information requested, the requested QoS, identity of 
serving cell and UE capability to support LPP. 

NOTE: If the UE is in connected mode and step 2 was not performed immediately after step 1, the MME may not 
have the most current serving cell identity if there was an intra-eNodeB handover. 



9.1.17.1 



Positioning IVIeasurement Establishment Procedure 



3) If the requested location information and the location accuracy within the QoS can be satisfied based on 

parameters received from the MME, e.g. cell identity, the E-SMLC may send a Location Response immediately. 
Otherwise, the E-SMLC determines the positioning method and instigates the particular message sequence for 
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this method as described in clause 9.3a. If the position method returns position measurements, the E-SMLC uses 
them to compute a location estimate. If there has been a failure to obtain position measurements, the E-SMLC 
may use the current cell identity to derive an approximate location estimate. If an already computed location 
estimate is returned for an UE based position method, the E-SMLC may verify consistency with the current cell 
identity. If the location estimate so obtained does not satisfy the requested accuracy and sufficient response time 
still remains, the E-SMLC may instigate a further location attempt using the same or a different position method. 
If a vertical location co-ordinate is requested but the E-SMLC can only obtain horizontal co-ordinates, these may 
be returned. 

9.1 .1 7.2 Location Calculation and Release Procedure 

4) When a location estimate best satisfying the requested QoS has been obtained, the E-SMLC returns a Location 
Response to the MME with an indication whether the obtained location estimate satisfies the requested accuracy 
or not. This message carries the location estimate that was obtained. If a location estimate was not successfully 
obtained, a failure cause is included in the Location Response. 

5) The MME may determine the GMLC and emergency services client using the cell identity or the location 
estimate or according to some fixed association for the MME. The MME shall send a Subscriber Location 
Report to the GMLC carrying the IMEI and if available the IMSI and MSISDN of the UE, the event causing the 
message (EPC NI LR), and, if these were obtained in steps 2 to 4, the location estimate and its age and the 
indication received from E-SMLC whether the obtained location estimate satisfies the requested accuracy or not. 
The serving cell identity of the UE may also be sent if available. The MME shall include its own address. The 
MME may record charging information. 

6) The GMLC shall acknowledge receipt of the location estimate provided that the associated LRF serves the 
emergency services LCS client and the client is accessible. These conditions would normally be fulfilled if the 
LRF either already has created, or expects to later create, a record for the UE for the emergency services session 
as described in clause 9.8.4. 

7) The LRF associated with the GMLC treats the received location estimate as described in clause 9.8.4: e.g. may 
use the location information to assist routing of the emergency session to the PS AP/emergency centre and/or 
may transfer the location information to the emergency services LCS client immediately or upon request from 
the client. The LRF/GMLC may store the information received in step 5: e.g. may store the UE identity and the 
address of the MME. The LRF/GMLC may record charging information. 

NOTE: Determination of the GMLC in step 5 must ensure a match with any LRF/GMLC used by the IMS Core 
to assist with location retrieval for, and/or routing of, the IMS Emergency call as described in 
clause 9.8.4. 

9.1 .18 EPC Post Positioning Notification and Verification Procedure 

Figure 9.21 illustrates the post positioning notification and verification procedure. 
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Figure 9.21 : EPC Post Positioning Notification and Verification Procedure 

1) Common PS and CS MT-LR procedure as described in clause 9.1.1. 

2) The GMLC sends a Provide Subscriber Location message to the MME with an indication of "notification only". 
This message carries the UE subscriber's IMSI. For a session related location request, the message also carries 
the APN-NI to which the user has established the session. For a value added LCS client, the message shall carry 
the client name, the external identity of the LCS client and the Requestor Identity (if that is both supported and 
available), optionally the message may also carry the Service Type. Also the message may carry the type of the 
LCS client name and also the type of the Requestor identity if the requestor identity was included. If the result of 
the privacy check at H-GMLC/PPR indicated that the codeword shall be sent to the UE user, the message may 
carry also the codeword received from the LCS client. For a PLMN operator LCS client, the message shall carry 
the internal identity of the LCS client. If the Requestor Identity is provided, the GMLC shall send it as separate 
information. 

3) The MME first checks if the UE is detached or suspended. If this is the case, an error response is returned. The 
MME determines a required privacy related action as described in Annex A. 3 based on the indicators of privacy 
related action in the PSL message from the GMLC. If the UE is in ECM-IDLE state, the MME performs a 
network triggered service request as defined in TS 23.401 [41] in order to establish a signalling connection with 
the UE and assign a specific eNodeB. 

4) A notification invoke message is sent to the target UE indicating a location type of notification and verification 
only, the identity of the LCS client and the Requestor Identity (if that is both supported and available), whether 
privacy verification is required. Also the message may indicate the type of the LCS client name and also the type 
of the Requestor identity if the requestor identity was included. Moreover, the message may carry also the 
service type and the codeword. 
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5) The target UE notifies the UE user of the location request and, if privacy verification was requested, waits for the 
user to grant or withhold permission. The UE then returns a notification result to the MME indicating, if privacy 
verification was requested, whether permission is granted or denied. If the UE user does not respond after a 
predetermined time period, the MME shall infer a "no response" condition. The MME shall return an error 
response to the GMLC if privacy verification was requested and either the UE user denies permission or there is 
no response with the UE subscription profile indicating barring of the location request. 

6) The MME returns the indication of successful notification and verification result, if it has received a NAS 
Location Notification Return Result indicating that permission is granted. If a LCS Location Notification Return 
Result message indicating that permission is not granted is received, or there is no response, with the requested 
privacy action or the UE subscription profile indicating barring of location, the MME shall return an error 
response to the GMLC. 

7) Common MT-LR procedure in PS and CS domain as described in clause 9.1.1. 

9.2 Mobile Originating Location Request 

9.2.1 IVIobile Originating Location Request, Circuit Switclned (CS-IVIO-LR) 

The following procedure shown in figure 9.7 allows an UE to request either its own location and optionally, velocity, 
location assistance data or broadcast assistance data message ciphering keys from the network. Location assistance data 
may be used subsequently by the UE to compute its own location throughout an extended interval using a mobile based 
position method. The ciphering key enables the UE to decipher other location assistance data broadcast periodically by 
the network. The MO-LR after location update request may be used to request ciphering keys or GNSS assistance data 
using the follow-on procedure described in TS 24.008 [24]. The procedure may also be used to enable an UE to request 
that its own location be sent to an external LCS client. 
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Figure 9.7: General Network Positioning for CS-MO-LR 



Location Preparation Procedure 



1) If the UE is in idle mode, the UE requests a radio connection setup and sends a CM service request indicating a 
request for a call independent supplementary services to the VMSC/MSC server via RAN. 

2) RAN shall convey the CM service request to the core network. If the UE is in dedicated mode, the UE sends a 
CM Service Request on the already established radio connection. 

3) The VMSC/MSC server instigates authentication and ciphering if the UE was in idle mode or returns a Direct 
Transfer CM Service Accept if the UE was in dedicated mode. The UE will inform the network about its LCS 
capabilities, as described in chapter 6.3.4. 
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4) The UE sends a LCS CS-MO-LR Location Services invoke to the VMSC/MSC server. Different types of 
location services can be requested: location estimate of the UE, location estimate of the UE to be sent to an 
external LCS client, location assistance data or broadcast assistance data message ciphering keys. If the UE is 
requesting its own location estimate or that its own location be sent to an external LCS client, this message 
carries LCS requested QoS information (e.g. accuracy, response time, LCS QoS Class), the requested maximum 
age of location and the requested type of location (e.g. "current location", "current or last known location"). If 
the UE is requesting that its location be sent to an external LCS client, the message shall include the identity of 
the LCS client and may include the address of the GMLC through which the LCS client should be accessed. In 
addition, a Service Identity indicates which MO-LR service of the LCS Client is requested by the UE may be 
included. The message also may include a pseudonym indicator to indicate a pseudonym should be assigned by 
the network and transferred to the LCS Client as the UE's identity. If the UE is instead requesting location 
assistance data or ciphering keys, the message specifies the type of assistance data or deciphering keys and the 
positioning method for which the assistance data or ciphering applies. For an LCS CS-MO-LR Location Services 
invoke, the VMSC/MSC server shall assign a GMLC address, i.e. V-GMLC address, which is stored in the 
VMSC/MSC server. If a V-GMLC address is not available, the VMSC/MSC server may reject the location 
request. The VMSC/MSC server verifies in the UE's subscription profile that the UE has permission to request 
its own location, request that its location be sent to an external LCS client or request location assistance data or 
deciphering keys (whichever applies). If the UE is requesting positioning and has an established call, the 
VMSC/MSC server may reject the request for certain non-speech call types. 

5) In case the requested type of location is "current or last known location" and the requested maximum age of 
location information is sent from UE, the VMSC/MSC server verifies whether it stores the previously obtained 
location estimate of the target UE. If the VMSC/MSC server stores the location estimate and the location 
estimate satisfies the requested maximum age of location, this step and steps 6 and 7 may be skipped. Otherwise 
the VMSC/MSC server sends a Location Request message to RAN associated with the Target UE. The message 
indicates whether a location estimate or location assistance data is requested and, in GSM, includes the UE's 
location capabilities. If the UE's location is requested, the message also includes the requested QoS. If location 
assistance data is requested, the message carries the requested types of location assistance data. 

9.2.1 .2 Positioning Measurement Establishment Procedure 

6) If the UE is requesting its own location, RAN determines the positioning method and instigates the particular 
message sequence for this method, as specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, 

TS 43.059 [16]. If the UE is instead requesting location assistance data, RAN transfers this data to the UE as 
described in subsequent clauses in TS 25.305 [1] and TS 43.059 [16] UE. 

9.2.1 .3 Location Calculation and Release Procedure 

7) When a location estimate best satisfying the requested QoS has been obtained or when the requested location 
assistance data has been transferred to the UE, RAN returns a Location Report to the VMSC/MSC server with an 
indication whether the obtained location estimate satisfies the requested accuracy or not. This message carries 
the location estimate or ciphering keys if this was obtained. If a location estimate or deciphering keys were not 
successfully obtained or if the requested location assistance data could not be transferred successfully to the UE, 
a failure cause is included in the Location Report. 

8) If the location estimate was successfully obtained, the VMSC/MSC server shall send a MAP Subscriber 
Location Report to the V-GMLC assigned in the step 4, carrying the MSISDN/IMSI of the UE, the event causing 
the location estimate (CS-MO-LR) and the location estimate, its age, obtained accuracy indication and the LCS 
QoS Class requested by the target UE. In addition, the MAP Subscriber Location Report may include the 
pseudonym indicator, the identity of the LCS Client, the GMLC address and the Service Identity specified by the 
UE, if available. 

9) Upon receipt of the MAP Subscriber Location Report, the V-GMLC shall determine whether the UE requests 
transfer of its location estimate to an external LCS Client. If the identity of the LCS Client is not available, this 
step and steps 10 to 14 are skipped. Otherwise, the V-GMLC shall send the MO-LR Location Information to the 
H-GMLC (the V-GMLC may query the HLR/HSS of the UE to obtain the address of the H-GMLC), carrying the 
MSISDN/IMSI of the UE, the event causing the location estimate (CS-MO-LR), the location estimate and its age 
and the identity of the LCS Client. The pseudonym indicator and/or the GMLC address specified by the UE may 
also be included if available. 

10) If the pseudonym indicator is included in the MO-LR Location Information, the H-GMLC assigns or asks the 
PMD to assign a pseudonym to the UE. If the identity of the LCS Client and the GMLC address access to the 
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LCS Client are available, the H-GMLC shall send the MO-LR Location Information to the specified GMLC. If 
the identity of the LCS Client is available but the GMLC address access to the LCS Client is not available, the 
H-GMLC determines whether the specified LCS Client is accessible. If yes, the H-GMLC shall send the 
Location Information to the LCS Client, then the H-GMLC itself act as the specified GMLC, this step and step 
13 are skipped. If not, according to the LCS Client identity, the H-GMLC shall determine a GMLC that can 
access the LCS CUent, and send the MO-LR Location Information to the GMLC, carrying the MSISDN or the 
pseudonym of the UE, the identity of the LCS client, the event causing the location estimate (CS-MO-LR), 
location estimate and its age. 

ll)If the identified LCS Client is not accessible, this step and step 12 are skipped. Otherwise the GMLC transfers 
the location information to the LCS client, carrying the MSISDN/IMSI or the pseudonym of the UE, the event 
causing the location estimate (CS-MO-LR), the Service Identity, if available, and the location estimate and its 
age, in accordance with the LCS QoS Class requested by the target UE. If the UE requested LCS QoS class was 
Assured, GMLC sends the result to the LCS client only if the result has been indicated to fulfil the requested 
accuracy. If the UE requested LCS QoS class was Best Effort, GMLC sends whatever result it received to the 
LCS client with an appropriate indication if the requested accuracy was not met. 

12) If the LCS Client does not support MO-LR (for temporary or permanent reasons) or can not handle the location 
estimate of the UE, e.g. the LCS Client does not know the Service Identity, or the UE does not register to the 
LCS Client, the LCS Client have no corresponding data of the UE, the LCS Client shall return the Location 
Information ack message to the GMLC or the H-GMLC (in case the LCS Client received Location Information 
is sent from H-GMLC) with a suitable error cause. Otherwise, the LCS Client handles the location estimate 
according to the Service Identity, sends the GMLC or the H-GMLC the Location Information ack message 
signalling that the location estimate of the UE has been handled successfully. 

13) If the identified LCS Client is not accessible, the GMLC sends MO-LR Location Information Acknowledgement 
to the H-GMLC with an appropriate error cause. Otherwise, the GMLC shall send MO-LR Location Information 
Acknowledgement to the H-GMLC. The message shall specify whether the location estimate of the UE has been 
handled successfully by the identified LCS Client, and if not, the corresponding error cause obtained in step 12. 
The GMLC may record charging information both for the LCS Client and inter-operator revenue charges. 

14) In case the H-GMLC receives the MO-LR Location Information Acknowledgement from the GMLC, it shall 
forward the MO-LR Location Information Acknowledgement from the GMLC to the V-GMLC, and record 
charging information both for the UE and inter-working revenue charges. 

In case the H-GMLC receives the Location Information Acknowledgement from the LCS Client, it shall send 
MO-LR Location Information Acknowledgement to the V-GMLC. The message shall specify whether the 
location estimate of the UE has been handled successfully by the identified LCS Client, and if not, the 
corresponding error cause obtained in step 12. The H-GMLC shall record charging information both for the UE 
and inter-working revenue charges. 

15) In case the V-GMLC receives the MO-LR Location Information Acknowledgement from the H-GMLC, the V- 
GMLC shall record charging information both for the UE and inter-working revenue charges and send the MAP 
Subscriber Location Report Acknowledgement to the VMSC/MSC server, carrying the information specifies 
whether the location estimate of the UE has been handled successfully by the identified LCS Client, and if not 
success, the corresponding error cause obtained in step 14. 

In case the V-GMLC receives the MAP Subscriber Location Report from the VMSCAdSC server and it is not 
required to send to any LCS Client, the V-GMLC shall record charging information for the UE and response the 
MAP Subscriber Location Report Acknowledgement to the VMSC/MSC server. 

16) The VMSC/MSC server returns a CS-MO-LR Return Result to the UE carrying any location estimate requested 
by the UE including the indication received from RAN whether the obtained location estimate satisfies the 
requested accuracy or not, ciphering keys or an indicator whether a location estimate was successfully 
transferred to the identified LCS client. If the location estimate was successfully transferred to the identified LCS 
Client, the CS-MO-LR Return Result message shall specify whether the location estimate of the UE has been 
handled successfully by the identified LCS Client, and if not, the corresponding error cause obtained in step 15. 

17) The VMSC/MSC server may release the CM, MM and radio connections to the UE, if the UE was previously 
idle, and the VMSC/MSC server may record charging information. 
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9.2.2 Mobile Originating Location Request, Pacl^et Switclned (PS-MO-LR) 

The following procedure shown in figure 9.8 allows an UE to request either its own location and optionally, velocity; 
location assistance data or broadcast assistance data message ciphering keys from the network. Location assistance data 
may be used subsequently by the UE to compute its own location throughout an extended interval using a mobile based 
position method. A ciphering key enables the UE to decipher other location assistance data broadcast periodically by 
the network. The PS-MO-LR may be used to request ciphering keys or GNSS assistance data. The procedure may also 
be used to enable an UE to request that its own location be sent to an external LCS client. 
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Figure 9.8: General Network Positioning for packet switched MO-LR 



9.2.2.1 



Location Preparation Procedure 



1) In UMTS, if the UE is in idle mode, the UE requests a PS signalling connection and sends a Service request 
indicating signalling to the SGSN via the RAN. If the UE already has PS signalling connection, the UE does not 
need to send Service request. Security functions may be executed. These procedures are described in 

TS 23.060 [15]. In GSM this signalHng step is not needed. 

2) The UE sends a LCS PS-MO-LR Location Services invoke message to the SGSN. Different types of location 
services can be requested: location estimate of the UE, location estimate of the UE to be sent to an external LCS 
client, location assistance data or broadcast assistance data message ciphering keys. If the UE is requesting its 
own location or that its own location be sent to an external LCS client, this message carries LCS requested QoS 
information (e.g. accuracy, response time, LCS QoS Class), the requested maximum age of location and the 
requested type of location (e.g. "current location", "current or last known location"). If the UE is requesting that 
its location be sent to an external LCS client, the message shall include the identity of the LCS client and may 
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include the address of the GMLC through which the LCS client should be accessed. In addition, a Service 
Identity indicates which MO-LR service of the LCS Client is requested by the UE may be included. The message 
also may include a pseudonym indicator to indicate a pseudonym should be assigned by the network and 
transferred to the LCS Client as the UE's identity. If the UE is instead requesting location assistance data or 
ciphering keys, the message specifies the type of assistance data or deciphering keys and the positioning method 
for which the assistance data or ciphering applies. For an LCS PS-MO-LR Location Services invoke, the SGSN 
shall assign a GMLC address, i.e. V-GMLC address, which is stored in the SGSN. If a V-GMLC address is not 
available, the SGSN may reject the location request. The SGSN verifies the subscription profile of the UE and 
decides if the requested service is allowed or not. 

3) In case the requested type of location is "current or last known location" and the requested maximum age of 
location information is sent from UE, the SGSN verifies whether it stores the previously obtained location 
estimate of the target UE. If the SGSN stores the location estimate and the location estimate satisfies the 
requested maximum age of location, this step and steps 4 and 5 may be skipped. Otherwise the SGSN sends a 
Location Request message to the RAN associated with the Target UE's location. The message indicates whether 
a location estimate or location assistance data is requested. If the UE's location is requested, the message also 
includes the requested QoS. If location assistance data is requested, the message carries the requested types of 
location assistance data. The message carries also location parameters received in the Service Invoke message. 

9.2.2.2 Positioning Measurement Establishment Procedure 

4) If the UE is requesting its own location, the actions described in UTRAN Stage 2, TS 25.305 [1] or GERAN 
stage 2 TS 43.059 [16] are performed. If the UE is instead requesting location assistance data, the RAN transfers 
this data to the UE as described in subsequent clauses. The RAN determines the exact location assistance data to 
transfer according to the type of data specified by the UE, the UE location capabilities and the current cell. 

9.2.2.3 Location Calculation and Release Procedure 

5) When a location estimate best satisfying the requested QoS has been obtained or when the requested location 
assistance data has been transferred to the UE, the RAN returns a Location Report to the SGSN with an 
indication whether the obtained location estimate satisfies the requested accuracy or not. This message carries 
the location estimate or ciphering keys if this was obtained. If a location estimate or deciphering keys were not 
successfully obtained or if the requested location assistance data could not be transferred successfully to the UE, 
a failure cause is included in the Location Report. 

6) If the location estimate was successfully obtained, the SGSN shall send a MAP Subscriber Location Report to 
the V-GMLC assigned in the step 2, carrying the MSISDN/IMSI of the UE, the event causing the location 
estimate (PS-MO-LR) and the location estimate, its age, obtained accuracy indication and the LCS QoS Class 
requested by the target UE. In addition, the MAP Subscriber Location Report may include the pseudonym 
indicator, the identity of the LCS Client, the GMLC address and the Service Identity specified by the UE, if 
available. 

7) Upon receipt of the MAP Subscriber Location Report, the V-GMLC shall determine whether the UE requests 
transfer of its location estimate to an external LCS Client. If the identity of the LCS Client is not available, this 
step and steps 8 to 12 are skipped. Otherwise, the V-GMLC shall send the MO-LR Location Information to the 
H-GMLC (the V-GMLC may query the HLR/HSS of the UE to obtain the address of the H-GMLC), carrying the 
MSISDN/IMSI of the UE, the event causing the location estimate (PS-MO-LR), the location estimate and its 
age, and the identity of the LCS Client. The pseudonym indicator and/or the GMLC address specified by the UE 
may also be included if available. 

8) If the pseudonym indicator is included in the MO-LR Location Information, the H-GMLC assigns or asks the 
PMD to assign a pseudonym to the UE. If the identity of the LCS Client and the GMLC address access to the 
LCS Client are available, the H-GMLC shall send the MO-LR Location Information to the specified GMLC. If 
the identity of the LCS Client is available but the GMLC address access to the LCS Client is not available, the 
H-GMLC determines whether the specified LCS Client is accessible. If yes, the H-GMLC shall send the 
Location Information to the LCS Client, then the H-GMLC itself act as the specified GMLC, this step and step 
1 1 are skipped. If not, according to the LCS Client identity, the H-GMLC shall determine a GMLC that can 
access the LCS CUent, and send the MO-LR Location Information to the GMLC, carrying the MSISDN or the 
pseudonym of the UE, the identity of the LCS client, the event causing the location estimate (PS-MO-LR), 
location estimate and its age. 
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9) If the identified LCS Client is not accessible, this step and step 10 are skipped. Otherwise the GMLC transfers 
the location information to the LCS client, carrying the MSISDN/IMSI or the pseudonym of the UE, the event 
causing the location estimate (PS-MO-LR), the Service Identity, if available, and the location estimate and its 
age, in accordance with the LCS QoS Class requested by the target UE. If the UE requested LCS QoS class was 
Assured, GMLC sends the result to the LCS client only if the result has been indicated to fulfil the requested 
accuracy. If the UE requested LCS QoS class was Best Effort, GMLC sends whatever result it received to the 
LCS client with an appropriate indication if the requested accuracy was not met. 

10) If the LCS Client does not support MO-LR (for temporary or permanent reasons) or can not handle the location 
estimate of the UE, e.g. the LCS Client does not know the Service Identity, or the UE does not register to the 
LCS Client, the LCS Client have no corresponding data of the UE, the LCS Client shall return the Location 
Information ack message to the GMLC or the H-GMLC (in case the LCS Client received Location Information 
is sent from H-GMLC) with a suitable error cause. Otherwise, the LCS Client handles the location estimate 
according to the Service Identity, sends the GMLC or the H-GMLC the Location Information ack message 
signalling that the location estimate of the UE has been handled successfully. 

11) If the identified LCS Client is not accessible, the GMLC sends MO-LR Location Information Acknowledgement 
to the H-GMLC with an appropriate error cause. Otherwise, the GMLC shall send MO-LR Location Information 
Acknowledgement to the H-GMLC. The message shall specify whether the location estimate of the UE has been 
handled successfully by the identified LCS Client, and if not, the corresponding error cause obtained in step 10. 
The GMLC may record charging information both for the LCS Client and inter-operator revenue charges. 

12) In case the H-GMLC receives the MO-LR Location Information Acknowledgement from the GMLC, it shall 
forward the MO-LR Location Information Acknowledgement from the GMLC to the V-GMLC, and record 
charging information both for the UE and inter-working revenue charges. 

In case the H-GMLC receives the Location Information Acknowledgement from the LCS Client, it shall send 
MO-LR Location Information Acknowledgement to the V-GMLC. The message shall specify whether the 
location estimate of the UE has been handled successfully by the identified LCS Client, and if not, the 
corresponding error cause obtained in step 10. The H-GMLC shall record charging information both for the UE 
and inter-working revenue charges. 

13) In case the V-GMLC receives the MO-LR Location Information Acknowledgement from the H-GMLC, the V- 
GMLC shall record charging information both for the UE and inter-working revenue charges and send the MAP 
Subscriber Location Report Acknowledgement to the SGSN, carrying the information specifies whether the 
location estimate of the UE has been handled successfully by the identified LCS Client, and if not success, the 
corresponding error cause obtained in step 12. 

In case the V-GMLC receives the MAP Subscriber Location Report from the SGSN and it is not required to send 
to any LCS Client, the V-GMLC shall record charging information for the UE and response the MAP Subscriber 
Location Report Acknowledgement to the SGSN. 

14) The SGSN returns a Service Response message to the UE carrying any location estimate requested by the UE 
including the indication received from RAN whether the obtained location estimate satisfies the requested 
accuracy or not, ciphering keys or an indicator whether a location estimate was successfully transferred to the 
identified LCS client. If the location estimate was successfully transferred to the identified LCS Client, the 
Service Response message shall specify whether the location estimate of the UE has been handled successfully 
by the identified LCS Client, and if not, the corresponding error cause obtained in step 13. The SGSN may 
record charging information. 

9.2.3 MO-LR Request for Periodic Location Transfer to a TInird Party 

The following procedure shown in figure 9.8a allows a UE to instigate a periodic transfer of location to an external LCS 
client. The procedure would be executed once after which it would be followed by the procedure described in 

clause 9.1.12.2. 
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Figure 9.8a: Deferred MO-LR Initiation for Periodic Location in CS and PS domain 

1) to 2) If the UE is in idle mode, the UE requests a radio connection setup and sends a CM Service Request 
indicating a request for call independent supplementary service to the VMSC/MSC server via RAN (CS 
domain). If the UE is in dedicated mode, the UE sends a CM Service Request on the already established radio 
connection. The VMSC/MSC server instigates authentication and ciphering if the UE was in idle mode or returns 
a CM Service Accept if the UE was in dedicated mode. 

For PS domain, in UMTS, if the UE is in idle mode, the UE requests a PS signalling connection and sends a 
Service Request indicating signalling to the SGSN via RAN. If the UE already has PS signalling connection, the 
UE does not need to send the Service Request. Security functions may be executed. These procedures are 
described in TS 23.060 [15]. In GSM this signalling step is not needed. 

3) The UE sends an LCS MO-LR Invoke for periodic transfer of location to a third party LCS client. The UE shall 
include the periodic location related parameters (reporting interval and total number of reports). The UE shall 
also include the identity of the LCS client and may include the address of the GMLC through which the LCS 
client can be accessed. The UE may include a request for use of MO-LR Short Circuit (e.g. if the UE supports 
UE based positioning). The absence of an H-GMLC assigned LDR reference number in this case indicates that 
the request has not yet been authorized. 

4) to 7) The request to initiate periodic location shall be transferred in succession from the MSC/SGSN to the 

V-GMLC, H-GMLC, R-GMLC serving the LCS client and finally may be transferred to the LCS client. The 
periodic location parameters (reporting interval and number of reports) are included as well as any request for 
use of MO-LR Short Circuit. Any entity (MSC/SGSN, V-GMLC, H-GMLC, R-GMLC and, if notified, LCS 
Client) is enabled to accept or refuse the request. In addition, if the request was accepted, any entity is free to 
reject use of MO-LR Short Circuit. If the request is accepted, a LDR reference number is assigned by the 
H-GMLC. 
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8) to 11) The response transferred back to the MSC/SGSN shall indicate acceptance or rejection and whether 
MO-LR short circuit (if requested) has been accepted. The response also includes the LDR reference number 
assigned by the H-GMLC and the H-GMLC address. The H-GMLC may include in the response a list of PLMNs 
and possibly associated radio access technologies, either prioritized or non-prioritized, in which subsequent 
location estimates must be obtained and an indication for each PLMN (and possibly each associated radio access 
technology) of whether periodic location in the RAN is supported. If no list is included, subsequent locations are 
restricted to the current serving PLMN only 

12) The MSC/SGSN returns the result of the request to the UE in a LCS MO-LR Return Result message including 
the LDR reference number, the H-GMLC address any reporting PLMN list and an indication whether MO-LR 
Short Circuit is allowed (if requested by the UE in step 3. 

13a) The UE may instigate release of the CM, MM/GMM and radio connections - e.g. if the request was rejected or 
if the MSC/SGSN provided a list of PLMNs that did not include the serving PLMN (or if the serving PLMN was 
included in a prioritized list with a lower priority). Assuming the request was accepted, the UE may then initiate 
reporting of the first location estimate using the procedure described in clause 9.1.12.2 and beginning at step 1. 

13b) If the request was accepted and the serving PLMN can be used for subsequent location, the UE may initiate 
reporting of the first location estimate by sending an MO-LR request indicating transfer of location to the LCS 
Client using the procedure described in clause 9.1.12.2 and beginning at step 3. 

NOTE: If the UE receives a response in step 12 indicating that the MO-LR request for periodic location transfer 
to a third party cannot be supported (for temporary or permanent reasons), the UE may periodically 
invoke the MO-LR procedure for location transfer to a third party defined in clause 9.2.1 for the CS 
domain (CS-MO-LR) and in clause 9.2.2 for the PS domain (PS-MO-LR). 

9.2.4 MO-LR Request for Periodic Self Location 

The following procedure shown in figure 9.8b allows an UE to request its own location periodically if the RAN serving 
the target UE supports periodic location. This procedure is useful if a UE only supports UE-assisted positioning or has 
no positioning capabihty. 
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Figure 9.8b: MO-LR for Periodic Self Location with Periodic Positioning in the RAN 

1) to 2) If the UE is in idle mode, the UE requests a radio connection setup and sends a CM Service Request 
indicating a request for call independent supplementary service to the VMSC/MSC server via RAN (CS 
domain). If the UE is in dedicated mode, the UE sends a CM Service Request on the already established radio 
connection. The VMSC/MSC server instigates authentication and ciphering if the UE was in idle mode or returns 
a CM Service Accept if the UE was in dedicated mode. 

For PS domain, in UMTS, if the UE is in idle mode, the UE requests a PS signalling connection and sends a 
Service Request indicating signalling to the SGSN via RAN. If the UE already has PS signalling connection, the 
UE does not need to send the Service Request. Security functions may be executed. These procedures are 
described in TS 23.060 [15]. In GSM this signalling step is not needed. 

3) The UE sends an MO-LR invoke requesting periodic self location. The request includes the required QoS, the 
periodic location interval and the total number of reports. 

4) The MSC/SGSN sends a location request to the RAN containing the QoS and periodic location information 
received in step 3. 

5) RAN determines the positioning method and instigates the particular message sequence for this method, as 
specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

6) When a location estimate best satisfying the requested QoS has been obtained, RAN returns it to the 
MSC/SGSN. 
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7) The MSC/SGSN sends an LCS Location Update invoke to the UE containing the first location estimate. 

8) The UE acknowledges receipt of the first location estimate. If the UE wished to cancel the periodic location 
procedure at that point, an additional parameter (e.g. flag or cause value) is included in this message. 

9-12) As steps 5-8 for the second location estimate and thereafter repeated at the periodic location interval until the 
total number of reports is attained. 

13) After the final location estimate has been transferred in step 12, the MSC/SGSN returns an MO-LR return result 
to the UE to indicate completion of the periodic location request in step 3. As an implementation option, the final 
location estimate may be returned in the MO-LR return result in step 13 rather than in an LCS Location Update 
in step 1 1 . 

14) The MSC/SGSN instigates clearing of the CM, MM/GMM and radio connections. 

NOTE: If the UE receives a response in step 13 indicating that the MO-LR request for periodic self location 

cannot be supported (for temporary or permanent reasons), the UE may periodically invoke the MO-LR 
procedure for self location defined in clause 9.2.1 for the CS domain (CS-MO-LR) and in clause 9.2.2 for 
the PS domain (PS-MO-LR). 

9.2.5 WLAN UE Originated Procedure in l-WLAN 

Figure 9.8c describes the MO-LR procedure for LCS for I-WLAN. 
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Figure 9.8c: WLAN UE Originated Procedure in l-WLAN 

1 . The WLAN UE selects a WLAN AN and establishes the WLAN connection and is authenticated in l-WLAN. 
The tunnel is established with between WLAN UE and one of PDGs in PLMN. 

2. WLAN UE initiates positioning procedure by establishing a so called user plane connection with the GMLC/SLP 
and shall use the OMA SUPL mechanism specified by OMA (OMA AD SUPL [38], OMA TS ULP [39]) to 
transport location related assistance data and location information between the UE and GMLC/SLP. The UE 
may receive assistance data and determine its own location and send its location information to the GMLC/SLP 
or the UE sends measurement results to the GMLC/SLP. In case GMLC/SLP determines the location of the UE, 
the GMLC/SLP shall send the location information to the WLAN UE. The UE may also send the identifier of the 
access node (e.g., MAC address of the AP) to the GMLC and GMLC, possibly using an external database, maps 
this location identifier to the corresponding geographical information, e.g. coordinates or street address and 
returns the result to the UE. 

3. The location information obtained is transferred to external LCS client if requested by WLAN UE. The 
estimated position of a WLAN UE can be stored in the GMLC after WLAN UE originated positioning procedure 
for future uses subject to the privacy settings of the WLAN UE. If there is an LCS request from an external LCS 
Client, the stored location information can be delivered to the external LCS client if the stored location 
information satisfies LCS QoS requested. 
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9.2.6 Mobile Originating Location Request, EPC (EPC-MO-LR) 

The following procedure shown in figure 9.8d allows an UE to request either, its own location and optionally, velocity 
or location assistance data. Location assistance data may be used subsequently by the UE to compute its own location 
throughout an extended interval using a mobile based position method. The EPC MO LR may be used to request GNSS 
assistance data. The procedure may also be used to enable an UE to request that its own location be sent to an external 
LCS client. 
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Figure 9.8d: General Network Positioning for packet switched MO-LR 
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Location Preparation Procedure 



1) If the UE is in ECM-IDLE state, the UE performs a UE triggered service request as defined in TS 23.401 [41] 
in order to establish a signalling connection with the MME and assign a specific eNodeB. 

2) The UE sends a NAS PDU containing an MO-LR Request inside an RRC UL Information Transfer message to 
the eNodeB. The MO-LR Request may optionally include an LP? positioning message. The eNodeB forwards 
the MO-LR Request (including any embedded LPP message) to the MME inside an SlAP Uplink NAS 
Transport message. Different types of location services can be requested: location estimate of the UE, location 
estimate of the UE to be sent to an external LCS client or location assistance data. If the UE is requesting its own 
location or that its own location be sent to an external LCS client, this message carries LCS requested QoS 
information (e.g. accuracy, response time, LCS QoS Class), the requested maximum age of location and the 
requested type of location (e.g. "current location", "current or last known location"). If the UE is requesting that 
its location be sent to an external LCS client, the message shall include the identity of the LCS client and may 
include the address of the GMLC through which the LCS client should be accessed. In addition, a Service 
Identity indicates which MO-LR service of the LCS Client is requested by the UE may be included. The message 
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also may include a pseudonym indicator to indicate a pseudonym should be assigned by the network and 
transferred to the LCS Client as the UE's identity. If the UE is instead requesting location assistance data, the 
embedded LPP message specifies the type of assistance data and the positioning method for which the assistance 
data applies. For an LCS EPC-MO-LR requesting location transfer to an external LCS Client, the MME shall 
assign a GMLC address, i.e. V-GMLC address, which is stored in the MME. If a V-GMLC address is not 
available, the MME may reject the location request. The MME verifies the subscription profile of the UE and 
decides if the requested service is allowed or not. 

3) The MME selects a E-SMLC as described in clause 6.3.13 and sends a Location Request message to the selected 
E-SMLC. The Location Request message conveys any embedded LPP message in the MO-LR Request. Once an 
MME has selected an E-SMLC it must continue to use that E-SMLC for the duration of the session. The 
Location Request message indicates whether a location estimate or location assistance data is requested. If the 
UE's location is requested, the message also includes the requested QoS. If location assistance data is requested, 
the embedded LPP message will convey the requested types of location assistance data. The message carries also 
other location parameters received in the MO-LR Request message, the current cell identity obtained from S 1 - 
AP message that carries the NAS MO-LR Request, and the UE capability to support LPP. 

9.2.6.2 Positioning Measurement Establishment Procedure 

4) If the UE is requesting its own location, the actions described in clause 9.3a are performed. If the UE is instead 
requesting location assistance data, the E-SMLC transfers this data to the UE as described in clause 9.3a. 1. The 
E-SMLC determines the exact location assistance data to transfer according to the type of data specified by the 
UE, the UE location capabilities and the current cell. 

9.2.6.3 Location Calculation and Release Procedure 

5) When a location estimate best satisfying the requested QoS has been obtained or when the requested location 
assistance data has been transferred to the UE, the E-SMLC returns a Location Response to the MME with an 
indication whether the obtained location estimate satisfies the requested accuracy or not. This message carries 
the location estimate if this was obtained. If a location estimate was not successfully obtained, or if the requested 
location assistance data could not be transferred successfully to the UE, a failure cause is included in the 
Location Response. 

6) If the UE did not request transfer of its location to an external LCS Client in step 2, steps 6 to 13 are skipped. 
Otherwise, if the location estimate was successfully obtained, the MME shall send a Subscriber Location Report 
to the V-GMLC assigned in the step 2, carrying the MSISDN/IMSI of the UE, the event causing the location 
estimate (EPC-MO LR) and the location estimate, its age, obtained accuracy indication and the LCS QoS Class 
requested by the target UE. In addition, the Subscriber Location Report may include the pseudonym indicator, 
the identity of the LCS Client, the GMLC address and the Service Identity specified by the UE, if available. 

7) This step is the same as step 7 for a PS-MO-LR in clause 9.2.2.3 except that the V-GMLC receives a Subscriber 
Location Report instead of a MAP Subscriber Location Report. 

8) This step is the same as step 8 for a PS-MO-LR in clause 9.2.2.3. 

9) This step is the same as step 9 for a PS-MO-LR in clause 9.2.2.3. 
10)This step is the same as step 10 for a PS-MO-LR in clause 9.2.2.3. 

1 1) .This step is the same as step 11 for a PS-MO-LR in clause 9.2.2.3. 

12) .This step is the same as step 12 for a PS-MO-LR in clause 9.2.2.3. 

13) If the V-GMLC receives the MO-LR Location Information Acknowledgement from the H-GMLC, the V-GMLC 
shall record charging information both for the UE and inter-working revenue charges and send the Subscriber 
Location Report Acknowledgement to the MME, carrying the information specifies whether the location 
estimate of the UE has been handled successfully by the identified LCS Client, and if not success, the 
corresponding error cause obtained in step 12. 

If the V-GMLC receives the Subscriber Location Report from the MME and it is not required to send to any 
LCS Client, the V-GMLC shall record charging information for the UE and response the Subscriber Location 
Report Acknowledgement to the MME. 
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14) The MME returns a NAS MO-LR Response message to the UE carrying any location estimate requested by the 
UE including the indication received from E-SMLC whether the obtained location estimate satisfies the 
requested accuracy or not, or an indicator whether a location estimate was successfully transferred to the 
identified LCS client. If the location estimate was successfully transferred to the identified LCS Client, the MO- 
LR Response message shall specify whether the location estimate of the UE has been handled successfully by 
the identified LCS Client, and if not, the corresponding error cause obtained in step 13. The MME may record 
charging information. 

9.3 LCS signalling procedures specified in UTRAN and GERAN 
Stage 2 

The signalHng procedures in UTRAN and GERAN are defined in TS 25.305 [1] and TS 43.059 [16] respectively. 

9.3a LCS signalling procedures applicable to E-UTRAN 
9.3a. 1 UE Assisted and UE Based Positioning and Assistance Delivery 

The following procedure depicts a positioning service transaction that is used by the E-SMLC to support UE based 
positioning, UE assisted positioning and delivery of assistance data. A single location request from the MME may 
invoke one or more transactions, in which each transaction may perform a single positioning service (e.g. UE assisted 
positioning, UE capability retrieval). RAN positioning procedures related to E-SMLC and UE communication are 
specified in TS 36.355 [47]. 
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Figure 9.8e: UE Assisted and UE Based Positioning and Assistance Delivery Procedure 

Precondition: A Correlation identifier allocated by MME had been passed to the E-SMLC when the location 

session (i.e. EPC-MT-LR, EPC -MO-LR, or ECP-Nl-LR) was initiated. The Correlation identifier 
must be assigned such that it can be used to identify the E-SMLC serving the location session. 

1 . The E-SMLC sends a Location Information message to the MME carrying a Downlink Positioning Information 
and the Correlation identifier which may request location information from the UE, provide assistance data to the 
UE or query for the UE capabilities. 
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2. If the UE is in ECM-IDLE state (e.g. if the SI connection was previously released due to data and signalling 
inactivity), the MME performs a network triggered service request as defined in TS 23.401 [41] in order to 
establish a signalling connection with the UE. 

3. The MME forwards the Downlink Positioning Information to the serving eNodeB in a NAS Transport message 
conveyed by the Sl-AP Transport Message. The MME includes a Routing identifier, in the NAS transport 
message, representing the Correlation identifier associated with the location session between the MME and E- 
SMLC. 

4. The eNodeB forwards the Downlink Positioning Information and Routing identifier to the UE by NAS Transport 

Message. 

5. The UE stores any assistance data provided in the Downlink Positioning Information and performs any 
positioning measurements and location computation requested by the Downlink Positioning Information. 

6. If the UE is in ECM-IDLE state, the UE instigates a UE triggered service request as defined in TS 23.401 [41] in 
order to establish a signalling connection with the MME. 

7. The UE returns any location information obtained in step 5 or returns any capabilities requested in step 4 to the 
eNodeB in an Uplink Positioning Information included in the NAS Transport message. The Uplink Positioning 
Information may alternatively carry a request for further assistance data. The UE shall also include the Routing 
identifier in the NAS Transport Message received in step 4. 

8. The eNodeB forwards the Uplink Positioning Information and Routing identifier to the MME in a NAS 
Transport message. 

9. The MME forwards the Uplink Positioning Information and the Correlation identifier to the E-SMLC, based on 
the received Routing identifier, in a Positioning Response. Steps 6 to 9 may be repeated if the UE needs to send 
multiple messages to respond to the request received in Step 4. Steps 1 to 9 may be repeated to send new 
assistance data, and to request further location information and further UE capabilities. 

NOTE: The DL Positioning Information messages can be asynchronous. Once the E-SMLC sends at least one DL 
Positioning Information message towards the UE (steps 1-4), the UE can then send zero or more UL 
Positioning Information messages towards the E-SMLC (steps 6-9). The UE includes the same Routing 
identifier in each subsequent message. 

9.3a.2 Network Assisted and Network Based Positioning Procedure 

The following procedure is used by the E-SMLC to support network assisted and network based positioning. RAN 
positioning procedures related to E-SMLC and eNodeB communication are specified in TS 36.455 [48]. 
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Figure 9.8f: Network Assisted and Networit Based Positioning Procedure 

Precondition: A Correlation identifier allocated by the MME had been passed to the E-SMLC when the location 
session (i.e. EPC-MT-LR, EPC-MO-LR, or EPC-NI-LR) was initiated. 

1 . The E-SMLC sends a Location Information message to the MME carrying Network Positioning Information and 
Correlation identifier which may request location information for the UE from the E-UTRAN. 

2. If the UE is in ECM-IDLE state (e.g. if the SI connection was previously released due to data and signalling 
inactivity), the MME performs a network triggered service request as defined in TS 23.401 [41] in order to 
establish a signalling connection with the UE. 

3. The MME sends a Network Positioning Information message conveyed in a Sl-AP Transport Message to the 
serving eNodeB for the UE. The MME includes a Routing identifier in the Sl-AP Transport Message, 
representing the E-SMLC associated with the location session. 

4. The eNodeB obtains any location information for the UE requested in step 3. 

5. The eNodeB returns a Network Positioning Information message to the MME, conveyed in a Sl-AP Transport 
Message, containing the location information obtained in step 4. The eNodeB shall also include the Routing 
identifier in the Sl-AP Transport Message received in step 3. 

6. The MME returns the Network Positioning Information received in step 5 to the E-SMLC based on the received 
Routing identifier. Steps 1 to 6 may be repeated to request further location information and further E-UTRAN 
capabilities. 

NOTE: The Network Positioning Information messages can be asynchronous. Once the E-SMLC sends at least 

one Network Positioning Information message towards the eNodeB (steps 1-3), the eNodeB can then send 
zero or more Network Positioning Information messages towards the E-SMLC (steps 5-6). The eNodeB 
includes the same Routing identifier in each subsequent message. 

9.3a.3 Obtaining Non-UE Associated Network Assistance Data 

The following procedure is used by the E-SMLC to support network assisted and network based positioning. This 
procedure is not associated with a UE location session. It is used in a MME LCS stateless manner to obtain network 
assistance data from an eNodeB. RAN positioning procedures related to E-SMLC and eNodeB communication are 
specified in TS 36.455 [48]. 
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Figure 9.8g: Obtaining Networit Assisted Data 

1 . The E-SMLC sends a Location Information message to the MME carrying a Network Positioning Information 
which may request eNodeB position related information from the E-UTRAN. The target eNodeB identity and E- 
SMLC identity are included for MME routing purposes. 

2. The MME sends a Network Positioning Information message to the eNodeB, conveyed in a Sl-AP Transport 
Message. The MME includes a Routing identifier that represents the E-SMLC identity in a Sl-AP Transport 
Message. This Routing identifier is not dynamically retained at the MME (i.e., the MME remains LCS stateless). 

3. The eNodeB obtains position information related to the eNodeB. 

4. The eNodeB returns a Network Positioning Information message to the MME, conveyed in a Sl-AP Transport 
Message containing the location information obtained in step 3. The eNodeB also includes the Routing identifier 
in a Sl-AP Transport Message received in step 2. 

5. The MME returns the Network Positioning Information received in step 4 to the E-SMLC. The MME determines 
the E SMLC from the Routing identifier received in step 4. Steps 4 and 5 may be repeated, using the same 
Routing identifier if the eNB has multiple messages to respond to the request in Step 2. Steps 1 to 5 may be 
repeated to request further location information and further E-UTRAN capabilities. 

NOTE: The Network Positioning Information messages can be asynchronous. Once the E-SMLC sends at least 

one Network Positioning Information message towards the eNodeB (steps 1-2), the eNodeB can then send 
zero or more Network Positioning Information messages towards the E-SMLC (steps 4-5). 



9.4 Exception Procedures 



The procedures in this clause apply to all variants of an MT-LR, NI-LR and MO-LR where a Location Request message 
has been sent either to RAN, for a UE with GERAN or UTRAN access, or to an E-SMLC, for a UE with E-UTRAN 
access, in order to request some location service (e.g. provision of a location estimate for a target UE or transfer of 
assistance data to a target UE). 
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9.4.1 Procedures in the VMSC /MSC server 

After the VMSC /MSC server has requested a location service for a particular UE from RAN, certain events may occur 
that may temporarily or permanently interfere with the location service attempt. For each such event notified to the 
VMSC /MSC server, the VMSC /MSC server shall employ one of the following error recovery actions. 

Restart the Location Service 

This action shall be employed for any event that temporarily impedes a location service attempt and cannot be delayed 
until the location service attempt is complete. When such an event is notified to the VMSC /MSC server, it shall 
immediately cancel the location service attempt and the associated signalling dialogue with RAN, if this still exists by 
sending a "stop reporting" message to RAN. The "stop reporting" message shall contain the reason for the location 
procedure cancellation in A/Gb mode or the indication about the type of location request to cancel (e.g. direct) in lu 
mode. 

After aborting the location request dialogue with RAN, the VMSC /MSC server may queue the location service request 
until the event causing the restart has terminated (if not already terminated). The VMSC /MSC server may optionally 
wait for an additional time period (e.g. if the queuing delay is minimal) to ensure that any resources allocated in and by 
RAN have time to be released. The VMSC /MSC server may then send another location service request to RAN 
associated with the target UE. 

Abort the Location Service 

This action shall be employed for any event that permanently impedes a location service attempt, such as loss of the 
dedicated signalling channel to the target UE. When such an event is notified to the VMSC /MSC server, it shall cancel 
the current location service attempt and the associated signalling dialogue with RAN, if still existing, by sending a "stop 
reporting" message to RAN. The "stop reporting" message shall contain the reason for the location procedure 
cancellation in A/Gb mode or the indication about the type of location request to cancel (e.g. direct) in lu mode. The 
VMSC /MSC server shall then return an error response to the client or network entity from which the location request 
was originally received. The VMSC /MSC server shall also release all resources specifically allocated for the location 
attempt. 

The following table indicates the appropriate error recovery procedure for certain events. For events not listed in the 
table, the VMSC /MSC server need take no action. 

Table 9.1 : LCS Error Recovery Procedures in the VMSC /MSC server for certain Events 



Event 


VMSC /MSC server Error Recovery 


Release of radio channel to the UE 


Abort 


Any error response from RAN except for SRNC relocation or inter- 
MSC handover 


Abort 


In lu mode inter RNC hard handover, SRNC relocation and inter- 
MSC or MSC server handover 


Abort on lu level 

Restart after process is completed 


In A/Gb mode inter-MSC Handover and inter-BSC handover 


Restart after handover is completed 


InterSystem handover 


Restart after handover is completed 



If RAN is in an overload condition, it may reject a location request by indicating congestion. The VMSC /MSC server 
may reduce the frequency of future location service requests until rejection due to overload has ceased. 

9.4.2 Void 

9.4.3 Procedures in tine SGSN 

After the SGSN has requested a location service for a particular UE from RAN, certain events may occur that may 
temporarily or permanently interfere with the location service attempt. For each such event notified to the SGSN, the 
SGSN shall employ one of the following error recovery actions. 

Restart the Location Service 

This action shall be employed for any event that temporarily impedes a location service attempt and cannot be delayed 
until the location service attempt is complete. When such an event is notified to the SGSN, it shall immediately cancel 
the location service attempt and the associated signalling dialogue with RAN, if this still exists by sending a "stop 
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reporting" (lu mode) or "location abort" (A/Gb mode) message to RAN. The "stop reporting"/"location abort" message 
shall contain the reason for the location procedure cancellation. 

After aborting the location request dialogue with RAN, the SGSN may queue the location service request until the event 
causing the restart has terminated (if not already terminated). The SGSN may optionally wait for an additional time 
period (e.g. if the queuing delay is minimal) to ensure that any resources allocated in and by RAN have time to be 
released. The SGSN may then send another location service request to RAN associated with the target UE. 

Abort the Location Service 

This action shall be employed for any event that permanently impedes a location service attempt, such as loss of the 
radio channel to the target UE. When such an event is notified to the SGSN, it shall cancel the current location service 
attempt and the associated signalling dialogue with RAN, if still existing, by sending a "stop reporting"/"location abort" 
message to RAN. The "stop reporting"/"location abort" message shall contain the reason for the location procedure 
cancellation. The SGSN shall then return an error response to the client or network entity from which the location 
request was originally received. The SGSN shall also release all resources specifically allocated for the location 
attempt. 

The following table indicates the appropriate error recovery procedure for certain events. For events not listed in the 
table, the SGSN need take no action. 

Table 9.2: LCS Error Recovery Procedures in the SGSN for certain Events 



Event 


SGSN Error Recovery 


Release of radio channel to the UE 


Abort 


Any error response from RAN causing unavailable signalling 
connections 


Abort 


Inter RNC hard handover, Inter SRNC relocation (lu mode 
only) 


Abort on lu level 

Restart after process is completed 


Suspend of GPRS services (A/Gb mode only)(During CS 
connection for class B UE) 


Abort 


Intra SGSN Routing Area Update (A/Gb mode only) 


Restart 


Inter SGSN Routing Area Update, inter SGSN relocation 


Abort (Note: GMLG may restart) 


Standalone P-TMSI Reallocation (/VGb mode only) 


Restart 



9.4.3a Procedures in the MME 

After the MME has requested a location service for a particular UE from an E-SMLC, certain events may occur that 
may temporarily or permanently interfere with the location service attempt. For each such event notified to the MME, 
the MME shall employ one of the following error recovery actions. 

Abort the Location Service: 

This action shall be employed for any event that permanently impedes a location service attempt, such as loss of the 
radio channel to the target UE or handover to a different MME. When such an event is notified to the MME, it shall 
cancel the current location service attempt and the associated signalling dialogue with the E-SMLC by sending a 
"location abort" message to the E-SMLC. The "location abort" message shall contain the reason for the location 
procedure cancellation. The MME shall then return an error response to the client or network entity (e.g. GMLC) from 
which the location request was originally received. The MME shall also release all resources specifically allocated for 
the location attempt. 

The following table indicates the appropriate error recovery procedure for certain events. For events not listed in the 
table, the MME need take no action. 
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Table 9.2a: LCS Error Recovery Procedures in the MME for certain Events 



Event 


MME Error Recovery 


UE Detach 


Abort 


Inter MME Tracking Area Update 


Abort 


E-UTRAN to UTRAN Routing Area Update 


Abort 


Inter MME and inter RAT handover 


Abort 


RRC or S1 connection release not due to User Inactivity 
(NOTE) 


Abort 


NOTE: The MME can determine the reason for an S1 connection release requested by the eNodeB from 
the Cause IE included in the UE Context Release Request message - see TS 36.413 [49]. 



Release SI Connection and Preserve the Location Service 

This action shall be employed when the MME receives a UE Context Release Request from the serving eNodeB where 
the cause IE indicates user inactivity. The MME shall release the S 1 connection but shall preserve and retain associated 
context information for the location service. 

9.4.4 Void 

9.4.5 Handover handling 

9.4.5.1 VMSC /MSC server procedure for Inter-VMSC /MSC server Handover 

When a location estimate is required for a target UE with an established call in a state of inter- VMSC /MSC server 
handover, the serving location area ID shall be used by the visited MSC /MSC server to identify the correct RAN to 
serve the location request. All location request related messages shall be sent via MAP/E interface piggy-backed in 
MAP_FORWARD_ACCESS_SIGNALLING and MAP PROCESS_ACCESS_SIGNALLING between the visited and 
serving MSCs /MSC servers. 

9.4.5.2 Handling of an ongoing handover while a request for positioning arrives 

If during an ongoing handover procedure a request for location information arrives, the request shall be suspended until 
the handover is completed. On completion of the handover, the location preparation procedure shall continue. 

9.4.5.3 Handover handling in lu mode 

In case of hard handovers in lu mode, e.g. inter RNC hard handover, or Serving RNC relocation, and inter- MSC, MSC 
Server or SGSN handovers, the ongoing positioning process is aborted on lu level. In soft handovers where the Serving 
RNS and lu are relocated, any ongoing positioning process is also aborted on lu level. The MSC, MSC Server or SGSN 
shall restart the lu aborted location requests with the new Serving RNC. The new SGSN, however, shall not restart the 
location request after inter SGSN Routing Area Update or inter SGSN relocation. During intra and inter RNC soft and 
softer handovers the existing RRC connection can normally be used without any need to abort the on-going positioning 
process on lu level. 

9.4.5.4 Handover of an IMS Emergency Call with EPS/GPRS Access 

Handover of the PS bearer for an established or not yet established IMS emergency call may occur within the PS 
domain (i.e. intra E-UTRAN, intra UTRAN, E-UTRAN to UTRAN, UTRAN to E-UTRAN or E-UTRAN to HRPD) as 
defined in TS 23.401 [41], TS 23.402 [44] and TS 23.060 [15]. Handover of an already established IMS emergency call 
may also occur from the PS domain to the CS domain using SRVCC as defined in TS 23.216 [43]. When such an event 
occurs in a context where location support for the emergency call is required on the source side, continuity of location 
support may be required on the target side. In this case, the location solution employed on the source and target access 
sides may stay the same or may change. In addition, some reconfiguration of the associated location server or servers 
(e.g. GMLC, LRF, E-SLP) may be needed whether or not the solution changes. Table 9.2a summarizes the support of 
all possible handover scenarios. Note that in all cases, the LRF that was originally assigned to the IMS emergency call 
as described in clause 9.8.4 must be retained after handover in order to avoid any impact to the emergency centre/PS AP. 
However, other location server changes (e.g. addition or removal of a GMLC) may occur following handover as 
summarized in Table 9.2a. 
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Table 9.2a: Location Reconfiguration Requirements for handover of an Emergency PS Bearer or IMS 
Emergency Call to support Location Continuity (Note 1) 

NOTE: The source side can choose to send an update even with no active location. 
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Source 
Access 
Side(s) 


Target 
Access 
Side(s) 


Source 
Location 
Solution 


Target 
Location 
Solution 


Reconfiguration Requirements 


E-UTRAN, 
UTRAN PS 


E-UTRAN, 
UTRAN PS 


TS 23.271 


TS 23.271 


Either (a) Source side SGSN or MME 
transfers the target side SGSN or MME 
identity to the source side GMLC 
Or (b) Target side SGSN or MME transfers its 
own identity to the target side GMLC (Note 2) 

Source or target side GMLC updates the LRF 

LRF replaces the source side GMLC with the 
target side GMLC if the GMLCs are different 


E-UTRAN, 
UTRAN PS 


E-UTRAN, 
UTRAN PS 


TS 23.271 


OMA SUPL 
[38], [39] 
(Note 3) 


Source side SGSN or MME transfers the 
target side SGSN or MME identity to the 
source side GMLC (Note 2) 

Source side GMLC updates the LRF 

LRF replaces the source side GMLC with a 
target side E-SLP 

LRF transfers the UE identity or address (e.g. 
IP address) to the target side E-SLP when the 
UE location is next needed. 


E-UTRAN, 
UTRAN PS 


E-UTRAN, 
UTRAN PS 


OMA SUPL 
[38], [39] 


TS 23.271 
(Note 3) 


Target side SGSN or MME transfers its own 
identity to the target side GMLC (Note 2) 

Target side GMLC updates the LRF 

LRF replaces the source side SUPL E-SLP 
with the target side GMLC 


E-UTRAN, 
UTRAN PS 


E-UTRAN, 
UTRAN PS 


OMA SUPL 
[38], [39] 


OMA SUPL 
[38], [39] 


None identified 


E-UTRAN 


HRPD 


TS 23.271 


OMA SUPL 
[38], [39] 


Source side MME transfers an HRPD 
indication and an HRPD identity if known (e.g. 
cell ID) to the source side GMLC (Note 2) 

Source side GMLC updates the LRF 

LRF replaces the source side GMLC with a 
target side E-SLP 

LRF transfers the UE identity or address (e.g. 
IP address) to the target side E-SLP when the 
UE location is next needed. 


E-UTRAN, 
UTRAN PS 


UTRAN CS 
GERAN CS 


TS 23.271 


TS 23.271 


Either (a) Source side SGSN or MME 
transfers the target side SRVCC MSC identity 
to the source side GMLC 
Or (b) Target side SRVCC MSC transfers its 
own identity to the target side GMLC (Note 2) 

Source or target side GMLC updates the LRF 

LRF replaces the source side GMLC with the 
target side GMLC if the GMLCs are different 


E-UTRAN, 
UTRAN PS 


UTRAN CS 
GERAN CS 


OMA SUPL 
[38], [39] 


TS 23.271 


Target side SRVCC MSC transfers its own 
identity to the target side GMLC (Note 2) 

Target side GMLC updates the LRF 

LRF replaces the source side SUPL E-SLP 
with the target side GMLC 


E-UTRAN 


1xRTT 


TS 23.271 


J-STD-036B 
[32] 
(Note 4) 


Either (a) Source side MME transfers the 
target side IxRTT MSC address to the source 
side GMLC 

Or (b) A target side update occurs (Note 2, 
Note 4) 
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Source side GMLC or Target side updates 
the LRF (Note 4) 

LRF replaces the source side GMLC with 
location support on the target side (Note 4) 


E-UTRAN 


1xRTT 


OMASUPL 
[38], [39] 


J-STD-036B 
[32] 
(Note 4) 


The target side updates the LRF (Note 4) 

The LRF replaces the source side E-SLP with 
location support on the target side (Note 4) 


NOTE 1 : It is assumed that all handovers are intra-operator and that a single LRF is used by an operator for 
all IMS emergency calls. Use of more than one LRF is FFS. 

NOTE 2: A source side update should be configured if the control plane location is used on the source side 
but will not be used on the target side. A target side update should be configured if the control plane 
location will be used on the target side but was not used on the source side. An update on either the 
source or target side but not both should be configured when the control plane location solution is or 
may be used on both sides. No update is needed when a user plane location solution is used on 
both sides. The knowledge of the location solution can also be configured - e.g. and may depend on 
the access type, the location capabilities of the UE and whether a UE is roaming or not.. 

NOTE 3: it is allowed to change location solution for an intra E-UTRAN or intra UTRAN PS handover as well 
as for inter-RAT PS handover although this is expected to be an unlikely scenario for handover 
within the same operator's networks. 

NOTE 4: actions on the target 1 xRTT side are outside the scope of this TS. 



Details concerning the interactions between the LRF, GMLCs, E-SLPs and any IxRTT location servers to support the 
reconfiguration requirements in Table 9.2a are outside the scope of this TS. Support of location continuity by other 
entities is defined below in association with Figure 9.8h. 
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Figure 9.8h: Support of Location Continuity for l-landover of an IIVIS Emergency Call 

1 . Following the request for an emergency call, the UE establishes an emergency PDN connection for E-UTRAN 
access as defined in TS 23.401 [41] or an emergency PDP context for UTRAN PS access as defined in 

TS 23.060 [15]. The UE may then establish an IMS emergency call as defined in TS 23.167 [36a] during which 
an LRF is assigned and a source location server (e.g. GMLC) may be chosen as described in clause 9.8.4 

2. At some later time, the serving MME or SGSN (hereafter referred to as the source SGSN or MME) may receive 
a request from an associated GMLC (hereafter referred to as the source GMLC) for the location of the UE if the 
location solution defined in this TS is used on the source access side. 

3. If step 2 occurs or if support for an NI-LR is required, the source SGSN or MME starts a location session with 
the serving RNC or an E-SMLC, in each case respectively, to obtain the location of the UE. 
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4. A request is later sent to the source SGSN or MME from the serving eNodeB (for E-UTRAN access) or serving 
RNC (for UTRAN access) for a handover to a particular target eNodeB (for handover to E-UTRAN) or target 
RNC (for handover to UTRAN PS) or target MSC server (for handover to UTRAN CS or GERAN CS) or target 
cell associated with a particular IxRTT MSC (for handover to IxRTT) or HRPD target cell (for handover to 
HRPD). 

5. For handover to E-UTRAN, UTRAN PS, UTRAN CS or GERAN CS, the source MME or SGSN sends a 
Handover Request message to the target MME, SGSN, MSC server or MSC server (hereafter referred to as the 
target serving node) in each case respectively as defined in TS 23.401 [41], TS 23.060 [15] or TS 23.216 [43]. 
For handover from E-UTRAN to IxRTT, the source MME initiates a handover to a target IxRTT IWS using 
single radio voice call continuity procedures as described in TS 23.216 [43]. For handover from E-UTRAN to 
HRPD, this step does not occur. 

6. The rest of the handover preparation and execution procedure is completed as defined in TS 23.401 [41], 
TS 23.402 [44], TS 23.060 [15] or TS 23.216 [43]. 

7. The location session started in step 3 may terminate normally before step 6 is complete. If not, the source SGSN 
or MME shall abort the session once step 6 is complete. This may lead to provision of a location estimate for the 
UE to the source SGSN or MME. 

8a. If the location solution defined in this TS is used on the source side and step 2 occurred, the source SGSN or 
MME returns a Provide Subscriber Location response to the source GMLC carrying any location estimate 
obtained previously for the UE. Depending on configuration information in the source SGSN or MME (e.g. 
which may be related to the source and target serving node identities, the location capabilities of the UE and 
whether the UE is roaming or not), the Provide Subscriber Location response may, except for handover to 
HRPD, convey the identity of the target serving node. 

8b. If the location solution defined in this TS is used on the source side but steps 2 and 8a do not occur, the source 
SGSN or MME may depending on configuration information in the source SGSN or MME (e.g. as in step 8a) 
send a Subscriber Location Report to the source GMLC carrying the UE identity (IMSI, MSISDN and/or IMEI), 
an event type indicating handover and, except for handover to HRPD, the identity of the target serving node. 

9. The source GMLC acknowledges the message in step 8b if this occurs. 

10. Steps 10 and 1 1 only apply when the target side supports a 3GPP access type (e.g. do not apply to IxRTT or 
HRPD). Depending on configuration information in the target serving node (e.g. which may be related to the 
source and target serving node identities, the location capabilities of the UE and whether the UE is roaming or 
not), the target serving node may after handover in step 6 is complete send a Subscriber Location Report to a 
GMLC on the target side if the location solution defined in this TS will be used on the target side. The 
Subscriber Location Report carries the UE identity (IMSI, MSISDN and/or IMEI), an event type indicating 
handover and the identity of the target serving node. However, no location estimate is included. The target 
serving node may determine the address of the target GMLC from configuration information. 

11. The target GMLC acknowledges the message in step 10. 

12. Reconfiguration of the LRF and the source and target location servers may occur as summarized in Table 9.2a 
which may involve removal of a source GMLC or E-SLP, assignment of a new target GMLC or E-SLP and/or 
updating of information in the LRF and in the source/target location server(s). The details of this step are outside 
the scope of this TS. 

13. If the LRF needs a location estimate for the UE after handover has occurred, it may instigate an MT-LR request 
via either the target GMLC if the location solution defined in this TS will be used on the target side or a target 
E-SLP if the location solution defined in OMA SUPL [38], [39] will be used. This will involve a repetition of 
step 2 on the target side if the location solution defined in this TS is used. Steps 2 to 12 may also be repeated on 
the target side to support a further handover if the previous handover was to either E-UTRAN or UTRAN PS. 

9.5 Privacy 

9.5.1 Privacy Override Indicator (POI) 

The POI is used to determine whether the privacy settings of the subscriber to be positioned shall be overridden by the 
request for location services. The POI is applicable only to Emergency service and Lawful intercept service. The 
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assignment of a POI value with an "override" or "not override" value in the LCS client profile is done during the LCS 
client provisioning. The type of LCS client requesting location information (i.e. emergency, law-enforcement etc.) shall 
determine the value of the POI assigned to the LCS client profile. 

POI is not sent to the MME. 

There are two distinct cases regarding the handling of the privacy override indicator. 

Procedure A: If the subscriber to be positioned is in the same country as the GMLC or if the subscriber to be 
positioned is in a different country than the GMLC and an appropriate bilateral agreement exists between operators, 
then the POI shall override the subscriber's privacy options, as allowed by regulatory requirements. 

Procedure B: Otherwise the POI shall not override the subscriber's privacy options. 



9.5.2 Privacy Procedures 



The privacy profile of the UE subscriber (SLPP) may for GSM and UMTS be stored in HLR/HSS and/or in H- 
GMLC/PPR. The privacy profile of the UE subscriber (SLPP) shall for EPS be stored in H-GMLC/PPR. If the privacy 
profile data are stored in SLPP of H-GMLC/PPR, then the pseudo external identities, if required, shall be contained in 
the SLPP of the HLR/HSS. Also if the privacy profile data are stored in H-GMLC/PPR, H-GMLC/PPR sends the 
indicators of privacy related action or the pseudo external identities to the serving nodes in order to inform the results of 
the privacy check procedures in H-GMLC/PPR. 

The SLPP stored in the HLR/HSS shall be downloaded to the VMSC, MSC Server and SGSN together with the rest of 
his subscription information in the existing operation INSERT_SUBSCRIBER_DATA. It will be deleted with the 
existing operation DELETE_SUBSCRIBER_DATA. 

In case of an Emergency Services location request, based on the location of the "VMSC/MSC Server/SGSN and the R- 
GMLC, the V -GMLC evaluates whether to accept or ignore the received POI, according to the definition in clause 
9.L5. If privacy override is not allowed, then the V-GMLC rejects the request. 

In case the privacy override i s allowed, the POI is transferred from the GMLC to the VMSC/MSC Server/SGSN in the 
location request. Based on the location of the GMLC the VMSC/MSC Server/SGSN evaluates whether to accept or 
ignore the received POI according to the definition in clause 9.5. L 

If the POI is accepted the location requested is unconditionally performed. Otherwise the VMSC/MSC Server/SGSN 
evaluates the privacy options in the UE subscriber's subscription profile (assuming this is held in the VLR/MSC 
Server/SGSN) or evaluates the received privacy related action indicators. If the corresponding register does not contain 
the UE subscription profile, LCS will rely on the existing GSM recovery mechanisms to obtain the profile. 

If local regulatory requirements mandate it, any MT-LR for an emergency services LCS client and any NI-LR for an 
emergency services call origination shall be allowed by the VMSC/MSC Server/SGSN/MME. 

If the location request is allowed by the privacy options the location request is performed. Otherwise, if the location 
request is barred by the privacy options, the location request is refused an error response is returned to the LCS client 
with a cause code indicating that the request was rejected by the subscriber. 



9.5.3 UE Privacy Options 



The UE privacy options in the SLPP apply to an CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR and either indicate that no 
CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR is allowed for the UE (except as may be ovemdden by the POI or local 
regulatory requirements) or define the particular classes of LCS client for which an CS-MT-LR/PS-MT-LR or 
NI-LR/PS-NI-LR for location are allowed, with the following classes being possible: 

[Editor's note: An e-mail comment pointed out that there are different cases still to be covered in the description of 
the classes: 1. the LCS Client identity is included in SLPP or 2. the LCS Client identity is NOT included 
in SLPP. Also some GMLC restriction conditions need to be mentioned.] 

a) Universal Class - allow positioning by all LCS clients; 

b) Call/Session related Class 

c) Call/Session-unrelated Class 
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d) PLMN operator Class 

Moreover the SLPP may contain the service types allowed by the subscriber. 

All UE privacy options of above four classes are commonly used for both CS and PS domain. 

The privacy classes are selected according to the rules described in the ANNEX A. If more than one privacy class are 

subscribed in the UE's SLPP, the looser privacy setting shall be selected. ANNEX A applies also in case service types 

privacy checking are subscribed together with one or more other privacy classes. 

NOTE 1 : If a privacy option setting in a domain is updated, the same modification will be applied to the other 
domain. 

NOTE 2: The options for each privacy class and the service type are described in the subsequent chapters 

independently from the options of the other privacy classes. The combination of the privacy class and 
service type options are described in the rules of Annex A 

9.5.3.1 Universal class 

When the user of the UE subscribes to the "Universal Class" the CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR 
positioning is allowed by all LCS clients. 

If the UE subscribes to the universal class, any CS-MT-LR or NI-LR shall be allowed by the VMSC/MSC Server and 
any PS-MT-LR or PS-NI-LR shall be allowed by the SGSN. 

If the UE subscribes to the universal class and H-GMLC/PPR knows that the serving node supports the indicator of 
privacy check related action, H-GMLC/PPR sends the indicators for call/session unrelated class, which indicates 
"Location allowed without notification". If the UE subscribes to the universal class and H-GMLC/PPR knows that the 
serving node does not support the indicator of privacy check related action, H-GMLC/PPR may sends the appropriate 
pseudo external identity as described in Annex C. 

9.5.3.2 Call/Session related class 

When the user of the UE subscribes to the "Call/Session related Class" the CS-MT-LR/PS-MT-LR/EPC-MT-LR or NI- 
LR/PS-NI-LR positioning is allowed in the following cases: 

Allow positioning by specific identified value added LCS client or groups of value added LCS Client to which the UE 
originated a call in CS domain or a value added LCS client with which the UE has a session via an active PDP context 
in PS domain indicated by a specific APN-NI. For each identified LCS client or group of LCS Clients, one of the 
following subscription options shall apply: 

* location request allowed only from GMLCs identified in the SLPP; 

* location request allowed only from a GMLC in the home country; 

* location request allowed from any GMLC (default case). 

For each identified value added LCS client or group of LCS Clients in the privacy exception list, one of the 
following subscription options shall apply: 

* positioning allowed without notifying the UE user (default case); 

* positioning allowed with notification to the UE user; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

For all value added LCS chents sending a call related CS-MT-LR/PS-MT-LR/EPC-MT-LR that are not 
identified in the privacy exception list, one of the following subscription option shall apply: 

* positioning not allowed; 

* positioning allowed without notifying the UE user (default case); 
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* positioning allowed with notification to the UE user; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

NOTE 2: The usage of Call/Session related Class in the IM subsystem is FFS. 

9.5.3.2.1 Call/session-related class in the CS-domain 

If the UE subscribes to the call/session-related class, an CS-MT-LR may be allowed if both of following conditions are 
met: 

The UE previously originated a call in CS domain that is still established and the called party number dialled by 
the UE matches the called party number received from the GMLC. 

The identity of the LCS client or LCS client group supplied by the GMLC matches the identity of any LCS 
Client or LCS Client group contained in the UE's SLPP and any other GMLC restrictions associated with this 
LCS Client identity in the SLPP are also met 

If these conditions are satisfied, the CS-MT-LR shall be allowed if the UE user subscribes to either location without 
notification or location with notification. If the UE user subscribes to location with notification and privacy verification, 
the CS-MT-LR shall be allowed following notification to the UE if the UE user either returns a response indicating that 
location is allowed or returns no response but subscribes to allowing location in the absence of a response. In all other 
cases, the CS-MT-LR shall be restricted. 

9.5.3.2.2 Call/session-related class in the PS-domain 

If the UE subscribes to the call/session-related class, a PS-MT-LR/EPC-MT-LR may be allowed if all of the following 
conditions are met: 

The UE previously originated a PDP/EPS Bearer-context towards the network where the external client is 
located and that this context is still established. 

- The APN-NI negotiated between the UE and SGSN/MME matches the APN-NI received from the GMLC. 

The identity of the LCS client or LCS client group supplied by the GMLC matches the identity of any LCS 
Client or LCS Client group contained in the UE's SLPP and any other GMLC restrictions associated with this 
LCS Client identity in the SLPP are also met. 

If these conditions are satisfied, the PS-MT-LR/EPC-MT-LR shall be allowed if the UE user subscribes to either 
location without notification or location with notification. If the UE user subscribes to location with notification and 
privacy verification, the PS-MT-LR/EPC-MT-LR shall be allowed following notification to the UE if the UE user either 
returns a response indicating that location is allowed or returns no response but subscribes to allowing location in the 
absence of a response. In all other cases, the PS-MT-LR/EPC-MT-LR shall be restricted. 

9.5.3.2.3 Call/session-related class when LCS client not in SLPP 

If the UE subscribes to the call/session related class, a CS-MT-LR, PS-MT-LR or EPC-MT-LR from an LCS cHent that 
is NOT contained in the SLPP of the target UE shall be allowed or restricted according to the following conditions: 

- For any non-matched LCS client, the CS-MT-LR, PS-MT-LR or EPC-MT-LR shall be allowed, if the UE user 
subscribes to either location without notification or location with notification. 

If the UE user subscribes to location with notification and privacy verification, the CS-MT-LR, PS-MT-LR or EPC- 
MT-LR shall be allowed following notification to the UE if the UE user either returns a response indicating that 
location is allowed or returns no response but subscribes to location in the absence of a response. In all other cases, the 
CS-MT-LR, PS-MT-LR or EPC-MT-LR shall be restricted. 
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9.5.3.3 Call/Session-unrelated class 

When the user of the UE subscribes to the "Call/Session unrelated Class" the CS-MT-LR/PS-MT-LR/EPC-MT-LR or 
NI-LR/PS-NI-LR positioning is allowed in the following cases: 

Allow positioning by specific identified value added LCS Clients or groups of value added LCS Client with the 
following restrictions allowed for each identified value added LCS Client or group of value added LCS Clients: 

* location request allowed only from GMLCs identified in the SLPP; 

* location request allowed only from a GMLC in the home country; 

* location request allowed from any GMLC (default case). 

For each identified value added LCS client in the privacy exception list, one of the following subscription 
options shall apply: 

* positioning allowed without notifying the UE user (default case); 

* positioning allowed with notification to the UE user; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

For all value added LCS clients sending a non-call/session related CS-MT-LR/PS-MT-LR/EPC-MT-LR that are 
not identified in the privacy exception list, one of the following subscription option shall apply: 

* positioning not allowed (default case); 

* positioning allowed with notification to the UE user; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

9.5.3.3.1 Call/session-unrelated class when LCS client identities match 

If the UE subscribes to the call/session-unrelated class, an CS-MT-LR/PS-MT-LR/EPC-MT-LR may be allowed by the 
MSC/MSC server, SGSN or MME if the identity of the LCS client or LCS client group supplied by the GMLC matches 
the identity of any LCS Client or LCS Client group contained in the UE's SLPP and any other GMLC restrictions 
associated with this LCS Client identity in the SLPP are also met. 

If the LCS client is correctly matched in this way and any GMLC restrictions are satisfied, the CS-MT-LR/PS-MT- 
LR/EPC-MT-LR shall be allowed if the UE user subscribes to either location without notification or location with 
notification. If the UE user subscribes to location with notification and privacy verification, the CS-MT-LR/PS-MT- 
LR/EPC-MT-LR shall be allowed following notification to the UE if the UE user either returns a response indicating 
that location is allowed or returns no response but subscribes to location in the absence of a response. In all other cases, 
the CS-MT-LR/PS-MT-LR/EPC-MT-LR shall be restricted. 

9.5.3.3.2 Call/session-unrelated class when LCS client identities do not match 

If the UE subscribes to the call/session-unrelated class, an CS-MT-LR/PS-MT-LR/EPC-MT-LR from an LCS client that 
is not contained in the UE's SLPP shall be allowed or restricted according to the following conditions. For any non- 
matched LCS chent, the CS-MT-LR/PS-MT-LR/EPC-MT-LR shall be allowed if the UE user subscribes to location 
with notification. If the UE user subscribes to location with notification and privacy verification, the CS-MT-LR/PS- 
MT-LR/EPC-MT-LR shall be allowed following notification to the UE if the UE user either returns a response 
indicating that location is allowed or returns no response but subscribes to location in the absence of a response. In all 
other cases, the CS-MT-LR/PS-MT-LR/EPC-MT-LR shall be restricted. 
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9.5.3.4 PLMN operator class 

When the user of the UE subscribes to the " PLMN operator Class" the CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR 
positioning is allowed in the following cases: 

Allow positioning by specific types of client within or associated with the VPLMN, with the following types of client 
identified: 



* 



* 



* 



* 



clients providing a location related broadcast service; 

O&M chent in the HPLMN (when the UE is currently being served by the HPLMN); 

O&M chent in the VPLMN; 

clients recording anonymous location information without any UE identifier; 

clients enhancing or supporting any supplementary service, IN service, bearer service or teleservice subscribed 
to by the target UE subscriber. 

If the UE subscribes to the PLMN class, an NI-LR/PS-NI-LR or CS-MT-LR/PS-MT-LR shall be allowed if the chent 
within the VPLMN, for an NI-LR/PS-NI-LR, or the client identified by the GMLC, for an CS-MT-LR/PS-MT-LR, 
either matches a generic type of client contained in the UE's SLPP or is otherwise authorized by local regulatory 
requirements to locate the UE. If H-GMLC/PPR knows that the serving node supports LCS capability set 4 or later, then 
H-GMLC/PPR will send the indicators for call/session unrelated class, which indicates 'location allowed without 
notification'. If H-GMLC/PPR is notified that the serving node does not support the LCS capability set 4 or later, then it 
will not send any indicator. 

9.5.3.5 Service type checking 

If the SLPP contains service types, a CS-MT-LR/PS-MT-LR may be allowed if the service type supplied by the LCS 
client matches the identity of any service type contained in the UE's SLPP and any other GMLC restrictions associated 
with this service type in the SLPP are also met. 

If the service type is correctly matched in this way and any GMLC restrictions are satisfied, the CS-MT-LR/PS-MT-LR 
shall be allowed if the UE user subscribes to either location without notification or location with notification. If the UE 
user subscribes to location with notification and privacy verification, the CS-MT-LR/PS-MT-LR shall be allowed 
following notification to the UE if the UE user either returns a response indicating that location is allowed or returns no 
response but subscribes to location in the absence of a response. In all other cases, the CS-MT-LR/PS-MT-LR shall be 
restricted. 

9.5.3.6 Matching of LCS client identities 

In evaluating privacy where any address "A" associated with the LCS client (e.g. LCS client ID or GMLC address) 
needs to be compared with a corresponding address "B" in the target UE's SLPP, a match shall be determined if a match 
is found for each of the following components of each address: 

a) numbering plan; 

b) nature of address indicator; 

c) corresponding address digits for all digits in "B" (the digits or initial digits in "A" must match all the digits in 
"B", but "A" may contain additional digits beyond those in "B"). 

All addresses shall be transferred to the MSC/VLR, MSC server or SGSN in international format, except for the called 
party number received from the GMLC during a Call-Related CS MT-LR when the LCS client was reached via IN or 
abbreviated number routing (e.g. toll-free number or emergency call routing). In these cases it is up to the GMLC to use 
the valid national specific number of the visited country. 

In evaluating privacy where an APN-NI associated with the LCS client notified by the GMLC needs to be compared 
with a corresponding APN-NI that is used to set up the associated PDP context, a match shall be determined if a match 
is found for each component of APN-NI. 
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9.5.4 Indicator of privacy clnecl< related action 

When the client type indicates value added service and the serving node supports LCS capability set 4 or later, H- 
GMLC/PPR shall select indicators for privacy check related action and the indicators shall be included in the 
Provide_Subscriber_Location request towards the serving node. The indication is sent to the serving node directly from 
the H-GMLC or via V-GMLC. There shall be an indicator for the call/session unrelated. For GSM and UMTS there 
shall be an optional indicator for the call/session related and it shall be sent only if call/session related identity, i.e. the 
number dialled by UE or APN-NI, is sent to the serving node. For EPS, there shall be an optional indicator for the 
session related and it shall be sent only if session related identity, i.e. APN-NI, is sent to the serving node. 

The possible values of the indicator of privacy check related action for call/session unrelated case shall be: 

Location allowed without notification 

Location allowed with notification 

Location with notification and privacy verification; location allowed if no response 

Location with notification and privacy verification; location restricted if no response 

Location not allowed (only applicable when the indicator for call/session related case is sent, or the POI is 
included in the provide subscriber location request) 

The possible values of the indicator of privacy check related action for call/session related case shall be: 

Location allowed without notification 

Location allowed with notification 

Location with notification and privacy verification; location allowed if no response 

Location with notification and privacy verification; location restricted if no response 

If both indicators are sent but indicating different actions and the call/session related criteria met in the serving node 
then an action according to the indicator with the looser action according to the definition in Annex A shall be chosen as 
shown in Annex A. 3. 

If the UE subscribes service types, then the result of the service type checking may be included in any of the privacy 
check indicators, as it is described in annex A. 3. 

If the UE subscribes either to PLMN class or to the universal class, H-GMLC/PPR sends the indicator for call/session 
unrelated class with the value of "Location allowed without notification". 

9.6 Mobile Originating Location 

An UE may subscribe to any of the following classes of mobile originating location: 

a) Basic Self Location; 

b) Autonomous Self Location; 

c) Transfer to Third Party. 

An MO-LR shall be allowed by the serving node (VMSC/MSC Server/SGSN/MME) if the type of request is supported 
by the appropriate subscription according to the following table. 

Table 9.3: Required UE Subscription Options for MO-LR Requests 



Type of MO-LR Request 


Required UE Subscription 


UE requests own location 


Basic Self Location 


UE requests location assistance data 


Autonomous Self Location 


UE requests transfer of own location to another LCS Client 


Transfer to Third Party 



£75/ 



3GPP TS 23.271 version 11.1.0 Release 11 1 41 ETSI TS 1 23 271 V1 1 .1 .0 (201 3-01 ) 

9.7 CM Procedures 

9.7.1 Location request for a mobile in idle-mode 

When a request for location information is received at the serving node the LCS-layer shall order paging of the UE 
subscriber. In case of first unsuccessful paging, normal paging procedures should apply. After successful paging the 
LCS-layer shall invoke the location preparation procedure. 

9.7.2 Location request for a mobile in dedicated-mode 

When a request for location information is received at the serving node, if the UE is already busy on CM level, the 
LCS-layer shall attempt to establish a parallel transaction to the existing one. If successful, the LCS-layer shall invoke 
the location preparation procedure. 

9.8 Interworking with the IMS 

9.8.1 Standard Location Request using a SIP-URI 

An external LCS Client shall use the same interface to the LCS Server regardless of the target UE's identity. 

If a location request from an external LCS client uses a SIP-URI as the target UE's identity, the requesting GMLC shall 
invoke a LIMS-IWF (Location IMS Interworking Function) to route the request to the user's home network. This 
routing mechanism may use standard technologies like pre-configuration of destination addresses or DNS lookups to 
determine the address of a LIMS-IWF in the home network of the user. The interface between two LIMS-IWF in 
different networks shall be Lr. 

If the LIMS-IWF in the home network is not co-located with the home GMLC, it shall use the same interface towards 
the home GMLC as the requesting GMLC, i.e. the Lr interface. The LIMS-IWF in the home network has to determine 
the HSS serving the user. This may be done e.g. by a Dh SLF query or the HSS address is known to the LIMS-IWF 
through configuration. The LIMS-IWF retrieves the MSISDN from the HSS through Sh Pull and use MAP Send 
Routing Info for LCS to get the home GMLC IP address from the HLR/HSS. Afterwards the LIMS-IWF in the home 
network can forward the LCS service request (including the target UE's MSISDN) on the Lr interface to the home 
GMLC. 

The following figure shows the principle call flow when a GMLC receives a location request where the target UE's 
identity is an IMS Pubhc User Identity (SIP-URI). 
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Figure 9.9: MT-LR procedure for IMS Public User Identities 

1 . An external LCS Client requests the current location of a target UE from a R-GMLC using the Public User 
Identity (SIP-URI) associated with the target UE. 

2. The R-GMLC selects a LIMS-IWF in the requesting network. The LIMS-IWF address may be pre-configured or 
DNS is used for this purpose. The R-GMLC forwards the LCS service request to the requested LIMS-IWF via Lr 
interface. 

3. The LIMS-IWF in the requesting network determines the LISM-IWF address in the home network. This may be 
done by using a pre-configured address or by DNS. The requesting LIMS-IWF forwards the LCS service request 
to the home LIMS-IWF via Lr interface. 

4. The home LIMS-IWF queries the SLF via Dh interface to get the HSS address (using the Dh interface to retrieve 
the HSS address is an option). 

5. The home LIMS-IWF retrieves the HSS address from the SLF via Dh SLF Response. 

6. The home LIMS-IWF queries the HSS via Sh PULL (including the SIP-URI) to get the user's MSISDN. 



£75/ 



3GPP TS 23.271 version 11.1.0 Release 11 1 43 ETSI TS 1 23 271 V1 1 .1 .0 (201 3-01 ) 

7. The home LIMS-IWF retrieves the user's MSISDN from the HSS via Sh PULL Response. 

8. The LIMS-IWF uses MAP Send Routing Info for LCS to get the H-GMLC address from the HLR/HSS. 

9. The LIMS-IWF retrieves the H-GMLC address from the HLR/HSS. 

10. The LCS service request is forwarded to the H-GMLC through Lr interface. 

1 1 . The H-GMLC performs the privacy check. 

12. The H-GMLC queries the HLR/HSS using MAP Send Routing Info for LCS to get the V-GMLC address. 

13. The H-GMLC retrieves the V-GMLC address from the HLR/HSS. 

14. The H-GMLC forwards the LCS service request to the V-GMLC. 

15. The standard MT-LR procedure is performed. 

16. The LCS service response is send from the V-GMLC to the H-GMLC. 

17. The H-GMLC performs the privacy check. 

18. The LCS service response is send from the H-GMLC to home LIMS-IWF. 

19. The LCS service response is send from the home LIMS-IWF to the requesting LIMS-IWF. 

20. The LCS service response is send from the requesting LIMS-IWF to the R-GMLC. 

21. The LCS service response is send from the R-GMLC to the external LCS Client. 

9.8.2 Standard Location Request using a TEL-URL 

IF a location request from an external LCS client uses a TEL-URL as the target UE's identity, the requesting GMLC 
shall convert the TEL-URL into a MSISDN, use this MSISDN in the location request as the target UE's address and 
continue with the MT-LR procedure for the PS domain. 

9.8.3 Mobile Originated Location Requests in tine IMS 

Mobile Originated Location Requests will not specifically require IMS interworking and therefore are not covered 
within this specification. 

9.8.4 IMS Emergency Location Procedure 

A common procedure to support location and PSAP/Emergency Centre selection for any type of access network is 
shown in TS 23.167 [36a] "Retrieving Location information for Emergency Session". The procedure may be used 
dependent on the access type and the requirements of the applicable regulatory authority. 



1 Information storage 



This clause describes information storage structures that are mandatory (M), conditional (C) or optional (O) for LCS, 
and the recovery and restoration procedures needed to maintain service if inconsistencies in databases occur and for lost 
or invalid database information. Information storage in RAN network elements is specified in UTRAN Stage 2 
(TS 25.305 [1]) and GERAN Stage 2 (TS 43.059 [16]) specifications. 

10.1 HLRanclHSS 

The HLR/HSS holds LCS data for both UE subscribers and LMUs. If the privacy profile data for UE subscribers are 
stored in H-GMLC/PPR, HLR/HSS needs to store the corresponding pseudo-external identities and MO-LR related 
subscription data shown in Table 10.4 and 10.5. The pseudo-external identities are stored in the privacy exception list 
shown in Table 10.2. The details of the pseudo-external identity are described in Annex C. 



£75/ 



3GPP TS 23.271 version 11.1.0 Release 11 



144 



ETSI TS 123 271 V1 1.1.0 (2013-01) 



1 0.1 .1 LCS Data in the HLR/HSS for an UE Subscriber 

The IMSI is the primary key for LCS UE subscription data in the HLR/HSS. This subscription data may be stored in a 
Multiple Subscriber Profile (MSP), with the HLR/HSS able to hold a number of MSPs per IMSI. 

For GSM and UMTS, the LCS UE subscription data includes a privacy exception list containing the privacy classes for 
which location of the target UE is permitted. Each privacy class is treated as a distinct supplementary service with its 
own supplementary service code. The following logical states are applicable to each privacy class (refer to 
TS 23.011 [22] for an explanation of the notation). 

Table 10.1 : Logical States for each LCS Privacy Class 



Provisioning State 


Registration State 


Activation State 


IHLR Induction State 


(Not Provisioned, 


Not Applicable, 


Not Active, 


Not Induced) 


(Provisioned, 


Not Applicable, 


Active and Operative, 


Not Induced) 



For each LCS privacy class, the HLR/HSS shall store the logical state of the class on a per-subscriber (or per subscriber 
MSP) basis. In addition, the permanent data indicated below shall be stored on a per subscriber (or per subscriber MSP) 
basis when the logical provisioning state of the associated LCS privacy class is "provisioned". For the meaning of each 
LCS privacy class, refer to clause 9 and to TS 22.071 [4]. 
Moreover a list of allowed service types may be stored. The meaning of service types is defined in TS 22.071 [4]. 
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Table 10.2: LCS data stored in the HLR privacy exception list for an UE Subscriber 

(or UE Subscriber IVISP) 



LCS Privacy Class 


Status 


Additional HLR Data when Class is provisioned 


Universal Class 


- 


No additional data 


Call/session Related Class 


M 


C 


C 


Indication of one of the following mutually exclusive options for any LCS 
client not in the external LCS client list: 

- Location not allowed 

- Location allowed without notification (default case) 

- Location allowed with notification 

- Location with notification and privacy verification; location allowed if no 
response 

- Location with notification and privacy verification; location restricted if 
no response 

External LCS client list: a list of zero or more LCS clients, with the following 
data stored for each LCS client in the list: 

- International E.1 64 address identifying a single LCS client or a single 
group of LCS clients that are permitted to locate this target UE 

- Restriction on the GMLC. If no value is stored for this data, there is no 
restriction on GMLC and any GMLC is allowed to request location 
information for the UE. Possible values are: 

- Identified GMLCs only 

- Any GMLC in the home country 

- Indication of one of the following mutually exclusive options: 

- Location allowed without notification (default case) 

- Location allowed with notification 

- Location with notification and privacy verification; location allowed if 
no response 

- Location with notification and privacy verification; location restricted 
if no response 


Call/session Unrelated 
Class 


M 


C 



C 


Indication of one of the following mutually exclusive options for any LCS 
client not in the external LCS client list: 

- Location not allowed (default case) 

- Location allowed with notification 

- Location with notification and privacy verification; location allowed if no 
response 

- Location with notification and privacy verification; location restricted if 
no response 

External LCS client list: a list of zero or more LCS clients, with the following 
data stored for each LCS client in the list: 

- International E.1 64 address identifying a single LCS client or a single 
group of LCS clients that are permitted to locate this target UE 

- Restriction on the GMLC. If no value is stored for this data there is no 
restriction on GMLC and any GMLC is allowed to request location 
information for the UE. Possible values are: 

- Identified GMLCs only 

- Any GMLC in the home country 

- Indication of one of the following mutually exclusive options: 

- Location allowed without notification (default case) 

- Location allowed with notification 

- Location with notification and privacy verification; location allowed if 
no response 

- Location with notification and privacy verification; location restricted 
if no response 


PLMN Operator Class 





LCS client list: a list of one or more generic classes of LCS client that are 
allowed to locate the particular UE. The following classes are distinguished: 

- LCS client broadcasting location related information 

- O&M LCS client in the HPLMN 

- O&M LCS client in the VPLMN 

- LCS client recording anonymous location information 

- LCS Client supporting a bearer service, teleservice or supplementary 
service to the target UE 
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Table 10.3: LCS Service types stored in the HLR/HSS per UE subscriber 



Service type indication 


Status 


Additional HLR data when the indication is stored 


Service Types 





Service types list: a list of one or more service types for which the LCS client 
is allowed to locate the particular UE. The possible service types are defined 
in TS 22.071 [4]. The following data may be present for each service type in 
the list: 







- Restriction on the GMLC. If no value is stored for this data, there is 
no restriction on GMLC and any GMLC is allowed to request 
location information for the UE. Possible values are: 




c 


- Identified GMLCs only 

- Any GMLC in the home country 

- Indication of one of the following mutually exclusive options: 

- Location allowed without notification (default case) 

- Location allowed with notification 

- Location with notification and privacy verification; location 
allowed if no response 

- Location with notification and privacy verification; location 
restricted if no response 



In case that UE's privacy profile is stored and is checked in the GMLC (H-GMLC) or in the PPR, pseudo-external 
identities may be set in the external LCS client list of the HLR privacy exception list shown in Table 10.2. The pseudo- 
external identity is not the identity of real external LCS client but the identity which is used for notifying SGSN/MSC 
of the location request class (call/session related or non-call/session related) and the required type of indication for each 
class. Operator allocates E. 164 addresses for the pseudo-external identities. 

Fourteen pseudo-external identities are needed to be defined. The pseudo-external identities are summarized in the 
Table C.l. The pseudo-external identities are registered in SLPP of each UE in advance. 

LCS UE subscription data may include a mobile originating list containing the LCS mobile originating classes that an 
UE is permitted to request. Each LCS mobile originating class is treated as a distinct supplementary service with its 
own supplementary service code. The following logical states are applicable to each mobile originating class (refer to 
TS 23.011 [22] for an explanation of the notation). 

Table 10.4: Logical States for each Mobile Originating LCS Class 



Provisioning State 


Registration State 


Activation State 


IHLR Induction State 


(Not Provisioned, 


Not Applicable, 


Not Active, 


Not Induced) 


(Provisioned, 


Not Applicable, 


Active and Operative, 


Not Induced) 



For each LCS Mobile Originating class, the HLR/HSS shall store the logical state of the class on a per-subscriber (or 
per subscriber MSP) basis. In this version of LCS, there is no additional permanent data in the HLR. The table below 
shows the defined mobile originating classes. For the meaning of each LCS mobile originating class, refer to clause 8 
and to TS 22.071 [4]. 

Table 10.5: Data stored in the HLR for the LCS Mobile Originating List for an UE 

(or UE Subscriber MSP) 



LCS Mobile Originating 
Class 


Status 


Additional HLR Data when Class is provisioned 


Basic Self Location 


- 


No additional data 


Autonomous Self Location 


- 


No additional data 


Transfer to Third Party 


- 


No additional data 
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In addition to the privacy exception list, the following other data items may be stored in the UE subscription profile in 
the HLR to support LCS. 

Table 10.6a: Temporary LCS data in the HLR 



Other Data in the HLR 


Status 


Description 


GMLC List 





List of one or more E.164 addresses of tine GMLCs from wliicli a 
location request for an IVIT-LR is allowed, The addresses are only 
relevant to an LCS client that is restricted (in the UE privacy exception 
list) to making call/session related or call/session unrelated location 
requests. 



10.2 VLR/SGSN 

The VLR/SGSN contains the same LCS permanent data for each registered UE subscriber, as does the HLR/HSS. This 
data is downloaded to the VLR/SGSN as part of the location update procedure between the VLR/SGSN and HLR/HSS 
for an UE subscriber. 

10.2a MME 

The MME contains the same LCS permanent data for each registered UE subscriber, as does the HSS. This data is 
downloaded to the MME as part of the Attach and Tracking Area Update procedures between the MME and HSS for a 
UE subscriber. 

10.3 GMLC 

1 0.3.1 LCS Data in the GMLC for a LCS Client 

The GMLC holds data for a set of external LCS clients that may make call related or non-call related MT-LR requests 
to this GMLC. The permanent data administered for each LCS client is as follows. 
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TablelO.7: GMLC Permanent Data for a LCS Client 



LCS Client data in GMLC 


Status 


Description 


LCS Client Type 


M 


Identifies the type LCS client from among the following: 

- Emergency Services 

- Value Added Services 

- PLMN Operator Services 

- Lawful Intercept Services 


External identity 





A list of one or more identifiers used to identify an external LCS client. 
The identity may be used when making an MT-LR and/or MO-LR. The 
format of the identity is an international E.164 address [35a]. Each 
external identity shall be associated with a logical client name. 


Authentication data 


M 


Data employed to authenticate the identity of an LCS client - details are 
outside the scope of the present document 


Call/session related identity 





A list of one or more international E.164 addresses [35a], which are used 
to make calls by mobile subscribers, or APN-NIs (see NOTE) to identify 
the client for a call related MT-LR 

In case the LCS client was reached via IN or abbreviated number routing 
(e.g. toll free number or emergency call routing), the E.164 number(s) 
stored in the GMLC shall be the number(s) that the UE has to dial to 
reach the LCS Client. In these cases the E.164 number is not to be in 
international format. The country in which the national specific number(s) 
is (are) applicable is (are) also stored (or implied) in this case. 
Each call related identity may be associated with a specific external 
identity. Each call/session-related identity shall be associated with a 
logical client name. 


Internal identity 





Identifies the type PLMN operator services and the following classes are 
distinguished: 

- LCS client broadcasting location related information 

- O&M LCS client in the HPLMN 

- O&M LCS client in the VPLMN 

- LCS client recording anonymous location information 

- LCS Client supporting a bearer service, teleservice or 
supplementary service to the target UE 

This identity is applicable only to PLMN Operator Services. 


Client name 





An address string which is associated with LCS client's external identity 
(i.e., E.164 address). See note 2. 


Client name type 





Indication what is the type of the LCS client name. The type of the LCS 
client name can be one of the following: 

- Logical name 

- MSISDN 

- E-mail address[33] 

- URL[33] 

- SIP URL[34] 

- IMS pubUc identity[35] 


Override capability 





Indication of whether the LCS client possesses the override capability 
(not applicable to a value added and PLMN operator service) 


Authorized UE List 





A list of MSISDNs or groups of MSISDN for which the LCS client may 
issue a non-call related MT-LR. Separate lists of MSISDNs and groups of 
MSISDN may be associated with each distinct external or non-call related 
client identity. 
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Priority 


M 


The priority of the LCS client - to be treated as either the default priority 
when priority is not negotiated between the LCS server and client or the 
highest allowed priority when priority is negotiated 


QoS parameters 


M 


The default QoS requirements for the LCS client, comprising: 

- Accuracy 

- Response time 

- LCS QoS Class 

Separate default QoS parameters may be maintained for each distinct 
LCS client identity (external, non-call related, call related) 


Service Coverage 





A list of E.1 64 country codes for geographic areas [35a] where the LCS 
client offers its location services. 


Allowed LCS Request Types 


M 


Indicates which of the following are allowed: 

- Non-call related CS-MT-LR/PS-MT-LR/EPC-MT-LR 

- Call/session related CS-MT-LR/PS-MT-LR/EPC-MT-LR 

- Specification or negotiation of priority 

- Specification or negotiation of QoS parameters 

- Specification or negotiation of Service Coverage parameter 

- Request of current location 

- Request of current or last known location 


Local Co-ordinate System 





Definition of the co-ordinate system(s) in which a location estimate shall 
be provided - details are outside the scope of the present document 


Access Barring List(s) 





List(s) of MSISDNs or groups of MSISDN for which a location request is 
barred 


Service Identities 





List of service identities allowed for the LCS client. 


Maximum Target UE Number 





The maximum number of the Target UEs in one LCS request. For a 
specific LCS Client, this parameter may have different values for different 
service identities. 



NOTE 1: The LCS Client is identified with E.164 number or APN-NI. APN-NI is specified in TS 23.003 [17]. 

NOTE 2: The LCS Client name should not contain two equal signs, because those characters are used to separate 
LCS client name from Requestor ID when GMLC includes them into the same field. 

1 0.3.2 LCS Data in the GMLC/PPR for a UE Subscriber 

The GMLC (H-GMLC) or PPR may store LCS UE subscription data. This chapter describes Rel-5 based privacy profile 
data stored in GMLC/PPR. If the home network operator uses Rel-5 compatible privacy profile data, the profiles shown 
in this chapter may be stored in GMLC/PPR. If the home network operator supports Rel-6 or later compatible privacy 
profile data, the profiles stored in the GMLC/PPR may be related to different geographic areas, i.e. subscribers may 
have different privacy profiles depending on subscribers' locations. 

The IMSI or MSISDN is the primary key for LCS UE subscription data in the GMLC/PPR. This subscription data may 
be stored in a Multiple Subscriber Profile (MSP), with the GMLC/PPR able to hold a number of MSPs per IMSI. 

LCS UE subscription data includes a privacy exception list containing the privacy classes for which location of the 
target UE is permitted. Each privacy class is treated as a distinct supplementary service with its own supplementary 
service code. The following logical states are applicable to each privacy class (refer to TS 23.011 [22] for an 
explanation of the notation). 

Table 10.9: Logical States for each LCS Privacy Class 



Provisioning State 


Registration State 


Activation State 


IHLR Induction State 


(Not Provisioned, 


Not Applicable, 


Not Active, 


Not Induced) 


(Provisioned, 


Not Applicable, 


Active and Operative, 


Not Induced) 
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For each LCS privacy class, the GMLC/PPR shall store the logical state of the class on a per-subscriber (or per 
subscriber MSP) basis. In addition, the permanent data indicated in Table 10.10 may be stored on a per subscriber (or 
per subscriber MSP) basis when the logical provisioning state of the associated LCS privacy class is "provisioned". For 
the meaning of each LCS privacy class, refer to clause 9 and to TS 22.071 [4]. 

Moreover a list of allowed service types may be stored. The meaning of service types is defined in TS 22.071 [4]. The 
numbers assigned to service types are defined in Annex G. 

Table 10.10: LCS data stored in the GMLC/PPR privacy exception list for an UE Subscriber 

(or UE Subscriber MSP) 



Service Types 





Service types list: a list of one or more service types for which the LCS 
client is allowed to locate the particular UE. The possible service types 
are defined in TS 22.071 [4] and the assigned numbers are shown in 
Annex G. The following data may be present for each service type in the 
list: 







- Restriction on the GMLC. If no value is stored for this data, there 
is no restriction on GMLC and any GMLC is allowed to request 
location information for the UE. Possible values are: 

- Identified GMLCs only 

- Any GMLC in the home country 




C 


- Indication of one of the following mutually exclusive options: 

- Location allowed without notification (default case) 

- Location allowed with notification 

- Location with notification and privacy verification; location allowed 
if no response 

- Location with notification and privacy verification; location 
restricted if no response 
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Table 10.11 : LCS Service types stored in the GIVILC per UE subscriber 



Service type indication 



Status 



Additional HLR data when the indication is stored 



Service Types 



O 



Indication of one of tine following mutually exclusive options for any 
service type not in the service type list: 

Location not allowed (default case) 

- Location allowed with notification 

Location with notification and privacy verification; location 
allowed if no response 

Location with notification and privacy verification; location 
restricted if no response 



Service types list: a list of one or more service types for which the LCS 
client is allowed to locate the particular UE. The possible service types 
are defined in TS 22.071 [4] and the assigned numbers are shown in 
Annex G. 

Restriction on the GMLC. If no value is stored for this data, 
there is no restriction on GMLC and any GMLC is allowed to 
request location information for the UE. Possible values are: 

- Identified GMLCs only 

Any GMLC in the home country 
Indication of one of the following mutually exclusive options: 

Location allowed without notification (default case) 

Location allowed with notification 

Location with notification and privacy verification; location 
allowed if no response 

Location with notification and privacy verification; location restricted if no 
response 



In case that UE's privacy profile is stored and is checked in the GMLC (H-GMLC) or in the PPR, the GMLC/PPR shall 
store the same pseudo-external identity table with HLR, which is shown in Annex C. 

GMLC (H-GMLC) or PPR may store codeword handling information and a list of codewords given by the UE 
subscriber in order not to get the location request rejected. 

Table 10.12a: Codeword handling information stored in the GMLC 



Other Data in the GMLC 


Status 


Description 


Codeword handling 
information 





Indication of one of the following mutually exclusive options for 
codeword: 

- codeword shall be checked in network. 

- codeword shall be sent to UE 



Table 10.12b: LCS data stored in the GMLC for a UE Subscriber 



LCS Privacy profile 


Status 


Additional GMLC data when profile is provisioned 


Codeword 





A list of codeword. 
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The GMLC (H-GMLC) or the PPR may store additional privacy information in order protect UE users privacy. The 
details of the additional privacy check are defined by each network operator and are outside the scope of this 
specification. 

10.4 Recovery and Restoration Procedures 

The LCS recovery and restoration procedures allow temporary data to be recovered or reinitialized following loss or 
corruption of data, such that normal LCS service is rapidly restored and inconsistency between the data held by 
different LCS network elements is removed. For a full description, refer to TS 23.007 [23]. 

10.5 Interworking between network nodes in different releases 

This clause describes possible scenarios for interworking between network nodes in different releases. It is noted that 
LCS is only supported in A-mode and lu-mode in the CS domain in Rel-99. LCS is supported in A-mode and lu-mode 
in UTRAN CS and PS domains, but not in Gb-mode, in Rel-4. LCS is supported in A/Gb mode and lu mode in CS and 
PS domains for UTRAN and GERAN in Rel-5, Rel-6, Rel-7 and Rel-8. LCS is supported in A/Gb mode and lu mode in 
CS and PS domains for UTRAN and GERAN and in the PS domain for E-UTRAN in Rel-9 onwards. 

The concept of LCS capabihty set is introduced in Rel-4, so it does not appear in the specifications for R98 and R99 
LCS. 

10.5.1 LCS capability set 

The following LCS capabilities are identified in the current version of this specification. The HLR/HSS is notified the 
LCS capability of the serving node by an indication, which indicates all the LCS the serving node supports, from the 
serving node during location update procedure. 

- LCS capability set 1 : R98 and R99 LCS (pre-Rel'4 LCS) 

- LCS capability set 2: Rer4 LCS 

- LCS capability set 3: Rel'5 LCS 

- LCS capability set 4: Rel'6 LCS 

- LCS capability set 5: Rel'? or later LCS 

NOTE 1 : the concept of LCS capability set is introduced in Rel4 so that R98 and R99 serving nodes do not notify 
HLR/HSS this parameter. Therefore, even if this parameter is absent the serving node may support at 
most LCS capability set I. 

NOTE 2: For E-UTRAN access, LCS capability sets 1 through 4 are not applicable. An MME that does not signal 
an LCS capability to the HSS shall be assumed to provide no LCS support. 

The serving node, which notified the HLR/HSS that it supports LCS capability set 2, shall be able to handle the 
extended LCS Client list and LCS Client List for call-related class from the HLR/HSS. 

The serving node, which notified the HLR/HSS that it supports LCS capability set 3, shall support the following 
capabilities: 

capability to perform the service type privacy check. 

capability to send the codeword to target UE for notification/verification. 

capability to send the requestor ID to target UE for notification/verification. 

The serving node, which notified the HLR/HSS that it supports LCS capability set 4, shall support the following 
capability: 

capability to perform the privacy related action (i.e. checking the on-going call/session and/or 
notification/verification procedures) which is requested by H-GMLC. 
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The serving node, which notified the HLR/HSS that it supports LCS capability set 5, shall support the following 
capability: 

capability to perform the privacy related action (i.e. checking the on-going call/session and/or 
notification/verification procedures) for notification based on current location which is requested by H-GMLC. 

1 0.5.2 Interworking between pre Rel-4 serving node and Rel-4 or later 
HLR/HSS 

The serving node that supports only pre-Rer4 LCS cannot handle the extended privacy control for call-related/call- 
unrelated class of the Rer4 and later LCS. That is, the serving node cannot provide the extended call -related/call- 
unrelated class service to the user who subscribes to the Rer4 LCS. Therefore HLR does not send the LCS subscriber 
data on call-related/call-unrelated class for users who subscribe to the call-related class of Rer4 LCS to the serving node 
that supports only pre-Rer4 LCS. 

10.5.3 Interworking between pre Rel-5 serving node and Rel-5 or later 
HLR/HSS 

If the HLR/HSS is notified that the LCS capability set 3 is not supported by the serving node, it may decide not to send 
the LCS subscriber data to the serving node, in order to protect user privacy. 

In addition, if the HLR/HSS is notified that the serving node does not support the LCS capability set 2, the procedures 
described in 10.5.2 also shall be applied. 

1 0.5.4 Interworking between pre Rel-6 network nodes and Rel-6 or later 
HLR/HSS 

In addition to the procedures in this section, if the HLR/HSS is notified that the serving node does not support the LCS 
capability set 2 and/or set 3, the procedures described in 10.5.3 shall be also taken into consideration. 

1 0.5.4.1 Rel-6 or later HLR/HSS with pre Rel-6 serving node 

The Rel-6 or later HLR/HSS notifies the H-GMLC about the all LCS capability set supported by the serving node. 

In accordance with the notified LCS capability of the serving node and the privacy profile of the target UE, the H- 
GMLC decides whether the location estimation process can be continued or not. 

In order to request the privacy related action (i.e. checking the on-going call/session and/or notification/verification 
procedures) to the pre Rel-6 serving node, H-GMLC may send the Provide Subscriber Location request message to the 
serving node with the pseudo-external identity. The detail of the pseudo-external identity is described in Annex C. 

10.6 LIMS-IWF 

As the LIMS-IWF is a simple interworking function that provides routing of LCS service requests and responses based 
on the target UE's SIP-URI and mapping of SIP-URI to MSISDN it must not store user or LCS Client specific data 
during or after a location request procedure. 



1 1 Operational Aspects 
11.1 Charging 

Charging Information collected by the PLMN serving the LCS Client. 
The following charging information shall be collected by the PLMN serving the LCS Client: 
type and identity of the LCS Client; 
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identity of the target UE; 

results (e.g. success/failure, method used if known, response time, accuracy) - to be repeated for each instance of 
positioning for a deferred location request; 

- identity of the visited PLMN; 

- LCS request type (i.e. LDR or LIR); 
requested Quality of Service information; 
state; 

type of event (applicable to LDR requests only); 

time stamp; 

type of co-ordinate system used. 

1 1 .2 Charging Information Collected by the Visited PLMN 

The following charging information shall be collected by the visited PLMN: 
date and time; 

type and identity of the LCS Client (if known); 
identity of the target UE; 

- location of the target UE (e.g., MSC, MSC Server, SGSN, MME, tracking area ID, location area ID, cell ID, 
location co-ordinates); 

which location services were requested; 

requested Quality of Service information; 

results (e.g. success/failure, positioning method used, response time, accuracy) - to be repeated for each instance 
of positioning for a batch location request; 

- identity of the GMLC or PLMN serving the LCS Client; 
state; 

type of event (applicable to LDR requests only). 
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Annex A (normative): 

Privacy Class selection rule in serving node 

A.1 Interrelation among privacy settings 

There are five privacy settings and the interrelation among each privacy setting in terms of privacy strictness is shown 
as follows: 

Table A.I : Privacy settings 



loose 


Positioning allowed without notifying the UE user 


T 


Positioning allowed with notification to the UE user 




Positioning requires notification and verification by the UE user; positioning is allowed only if 
granted by the UE user or if there is no response to the notification 


i 


Positioning requires notification and verification by the UE user; positioning is allowed only if 
granted by the UE user 


strict 


Positioning not allowed 



A.2 Privacy class selection rule for pre Rel-6 mechanism 

In pre Rel-6 network, the users privacy profile (SLPP) is stored HLR/HSS and is downloaded to the serving 
MSC/SGSN. If more than one privacy class are subscribed or in case Service Types and at least one privacy class are 
subscribed, privacy class for an MT-LR is selected by the serving MSC/SGSN according to the flow diagram shown in 
Fig. A-1. 

An MT-LR may be applied to more than one privacy class or to Service Types and one or more privacy classes. In this 
case, looser privacy setting shall be selected. The privacy settings to be compared are the results of the privacy checks 
for each applicable class and Service Type. 
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Yes 



PLMN Operator 
class 





Yes 


^-^^Call Unrelated^- 
\^ass subscribed?. 






1 


r 




Call Related/Call 




No 


Unrelated class 






[Note4] 




' 


' 






Call Related 








class 



Yes 



The location request is not 
allowed unconditionally 



Call Unrelated 
class 



The location request is not 
allowed unconditionally 



Note 1 : The client type indicates PLIVIN Operator service, and the client is within or associated with the VPLMN. 
Note 2: The client type indicates value added service; the UE originated call/session to the requesting LCS client is 

established and the address associated to the LCS client used by the UE in call/session set up matches 

with that contained in the location request. 
Note 3: The client type indicates value added service. 
Note 4: The looser privacy setting shall be selected. 

Figure A.I : Privacy Class selection flow diagram 

If the user subscribes Service Types, once that the privacy class has been selected according to figure A. 1, the resulting 
privacy setting shall be compared with the result of Service Type privacy checking, and the looser condition shall be 
applied to the MT-LR, provided that the LCS client was authorized by the UE user to get location information. 



A. 3 Privacy related action selection rule for Rel-6 and 
later 

In Rel-6 and later, the privacy checking function is moved from MSC/SGSN to H-GMLC/PPR of the target UE. This is 
also applied to EPS location request, i.e. privacy checking is done at H-GMLC/PPR of the target UE. H-GMLC/PPR 
selects one or two indicators of privacy check related action and sends the indicators to serving MSC/SGSN/MME as 
shown in the clause 9.5.4. If the user subscribes Service Types, the resulting privacy setting shall be compared with the 
result of Service Type privacy checking, and the looser condition shall be selected. The Service Type check result may 
be included in any of the two privacy indicators, provided that the MT-LR is allowed for the relative privacy class. 

If the serving MSC/SGSN/MME receives the indicators from H-GMLC, the serving node selects the privacy related 
action according to the flow diagram shown in Fig. A-2. 
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Call/session 
related class 



Call/session 
unrelated class 



The location request 
is not allowed 
unconditionally 



Figure A.2: Privacy related action selection flow diagram of the serving node 

NOTE 1 : The UE originated call/session to the requesting LCS client is established and the address associated to 
the LCS client used by the UE in call/session set up matches with that contained in the location request. 

NOTE 2: A prior change makes this check unnecessary; since the call unrelated indicator is mandatory therefore the 
result is always "YES". 
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Annex B (normative): 

Presence of LCS client ID Components in IVIT-LR 

The LCS client identity is composed of one or more than one of the following components: LCS client type, external 
identity, internal identity, call/session related identity, APN-NI, client name and Requestor Identity. For Value added 
LCS client type it may contain also Client name and Requestor ID type indicator. The LCS client type shall always be 
present and for each LCS client type the presence of the other components are defined as follows: 



Component 
LCS Client type 


External 
identity 


Internal 
identity 


Call/session 
related identity 


Client name 


Requestor 
Identity 


Emergency 





N.A. 


N.A. 


N.A. 


N.A. 


Value added 


M 


N.A. 


fNotel 


M 





PLMN operator 


N.A. 


M 


N.A. 


N.A. 


N.A. 


Lawful Intercept 


N.A. 


N.A. 


N.A. 


N.A. 


N.A. 



NOTE: This component shall be present if the MT-LR is associated to either CS call or PS session. If the MT-LR 
is associated with the CS call, the number dialled by UE is used. Otherwise if the MT-LR is associated 
with the PS session, the APN-NI is used. 
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Annex C (Informative): 
Pseudo external ID 



In case that UE's privacy profile is stored and is checked in the GMLC (H-GMLC) or in the PPR, a pseudo-external 
identity may be selected as a result of the privacy check in GMLC/PPR. 

The pseudo-external identities may be set in the external LCS client list of the HLR privacy exception list shown in 
Table 10.2. The pseudo-external identity is not the identity of real external LCS client but the identity which is used for 
notifying SGSN/MSC of the location request class (call/session related or non-related) and the required type of 
indication for each class. Operator allocates E.164 addresses for the pseudo-external identities. The pseudo-external 
identities are used for interworking with pre Rel-6 serving nodes. 

Fourteen pseudo-external identities shall be defined. The pseudo-external identities are summarized in the Table C.l. 

Table C.I : Pseudo-external identities 



Pseudo-external identity 


Privacy setting for Call/Session 
related class 


Privacy setting for Call/Session 
unrelated class 


Pseudo-external identity 1 


N.A. 


Location allowed without notification 


Pseudo-external identity 2 


N.A. 


Location allowed with notification 


Pseudo-external identity 3 


N.A. 


Location with notification and privacy 
verification; location allowed if no 
response 


Pseudo-external identity 4 


N.A. 


Location with notification and privacy 
verification; location restricted if no 
response 


Pseudo-external identity 5 


Location with notification and privacy 
verification; location restricted if no 
response 


Location not allowed 


Pseudo-external identity 6 
Indicator 6 


Location with notification and privacy 
verification; location allowed if no 
response 


Location not allowed 


Pseudo-external identity 7 


Location with notification and privacy 
verification; location restricted if no 
response 


Pseudo-external identity 8 


Location allowed with notification 


Location not allowed 


Pseudo-external identity 9 


Location with notification and privacy 
verification; location restricted if no 
response 


Pseudo-external identity 1 


Location with notification and privacy 
verification; location allowed if no 
response 


Pseudo-external identity 1 1 


Location allowed without notification 


Location not allowed 


Pseudo-external identity 12 


Location with notification and privacy 
verification; location restricted if no 
response 


Pseudo-external identity 1 3 


Location with notification and privacy 
verification; location allowed if no 
response 


Pseudo-external identity 1 4 


Location allowed with notification 



NOTE: There are five privacy settings shown in Annex A. 1 for each class (call/session unrelated class and 
call/session related class), so there are twenty-five possible combinations of the privacy settings. 
However, as shown in Annex A.2, even if the call/session related class criteria is met, the privacy setting 
for call/session unrelated class is selected when the privacy setting for the call/session unrelated class is 
looser than the privacy setting for the call/session related class. Therefore the twenty-five combinations 
can be reduced to the above fourteen combinations. 
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If the UE subscribes to the universal or PLMN class, H-GMLC/PPR sends the pseudo external identity 1 to the serving 
nodes. 

Usage of the pseudo-external identities are as follows: 

The pseudo-external identities are registered in SLFF of the HLR/HSS. 

The SLPP is sent to the serving nodes, during the Insert Subscriber Data procedures. 

After the privacy check in the H-GMLC/PPR, the H-GMLC/PPR selects an appropriate pseudo-external identity 
according to the required privacy related actions (i.e. checking the on-going call/session and/or 
notification/verification procedures) in the serving node. 

H-GMLC sends Provide Subscriber Location message to the serving node, which includes the pseudo-external 
identity instead of the real external client identity. The real external client identity may be included in the 
additional information element and is sent to serving node. The pseudo-external identity is sent to the serving 
node directly from H-GMLC or via V-GMLC. 

Table C.2 and C.3 shows how the pseudo-external identities are set in the SLPP in HLR/HSS. 

Table C.2: Example of SLPP in HLR/HSS for Call/Session unrelated Class 



Pseudo-external identity 


Privacy Setting 


Pseudo-external identity 1 


Location allowed without notification 


Pseudo-external identity 2 


Location allowed with notification 


Pseudo-external identity 3 


Location with notification and privacy verification; location 
allowed if no response 


Pseudo-external identity 4 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 5 


Location not allowed 


Pseudo-external identity 6 


Location not allowed 


Pseudo-external identity 7 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 8 


Location not allowed 


Pseudo-external identity 9 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 1 


Location with notification and privacy verification; location 
allowed if no response 


Pseudo-external identity 1 1 


Location not allowed 


Pseudo-external identity 1 2 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 1 3 


Location with notification and privacy verification; location 
allowed if no response 


Pseudo-external identity 1 4 


Location allowed with notification 
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Table C.3: Example of SLPP in HLR/HSS for Call/Session related Class 



Pseudo-external identity 


Privacy Setting 


Pseudo-external identity 5 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 6 


Location with notification and privacy verification; location 
allowed if no response 


Pseudo-external identity 7 


Location with notification and privacy verification; location 
allowed if no response 


Pseudo-external identity 8 


Location allowed with notification 


Pseudo-external identity 9 


Location allowed with notification 


Pseudo-external identity 1 


Location allowed with notification 


Pseudo-external identity 1 1 


Location allowed without notification 


Pseudo-external identity 1 2 


Location allowed without notification 


Pseudo-external identity 1 3 


Location allowed without notification 


Pseudo-external identity 1 4 


Location allowed without notification 



The selection of pseudo-external identity is based on the result of the privacy check in the H-GMLC/PPR. Table C.4 
shows the relation between privacy check result and the pseudo-external identities. 
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Table C.4: Pseudo-external identity selection at H-GIVILC/PPR 



Privacy related actions as a result of privacy check 


Pseudo-external identity 


Location request is allowed without notification, regardless 
of on-going call/session. 


Pseudo-external identity 1 


Location request is allowed with notification, regardless of 
on-going call/session. 


Pseudo-external identity 2 


Location request is allowed with notification and privacy 
verification, regardless of on-going call/session. Location 
request is allowed even if there is no response from UE. 


Pseudo-external identity 3 


Location request is allowed with notification and privacy 
verification, regardless of on-going call/session. Location 
request is restricted if there is no response from UE. 


Pseudo-external identity 4 


If there is call/session with the client, location request is 
allowed with notification and privacy verification. Location 
request is restricted if there is no response from UE. 
If there is no call/session with the client, location request is 
restricted. 


Pseudo-external identity 5 


If there is call/session with the client, location request is 
allowed with notification and privacy verification. Location 
request is allowed even if there is no response from UE. 
If there is no call/session with the client, location request is 
restricted. 


Pseudo-external identity 6 


If there is call/session with the client, location request is 
allowed with notification and privacy verification. Location 
request is allowed even if there is no response from UE. 
If there is no call/session with the client, location request is 
allowed with notification and privacy verification. Location 
request is restricted if no response. 


Pseudo-external identity 7 


If there is call/session with the client, location request is 

allowed with notification. 

If there is no call/session with the client, location request is 

restricted. 


Pseudo-external identity 8 


If there is call/session with the client, location request is 
allowed with notification. 

If there is no call/session with the client, location request is 
with notification and privacy verification. Location request is 
restricted if no response. 


Pseudo-external identity 9 


If there is call/session with the client, location request is 
allowed with notification. 

If there is no call/session with the client, location request is 
allowed even if there is no response from UE. 


Pseudo-external identity 1 


If there is call/session with the client, location request is 

allowed without notification. 

If there is no call/session with the client, location request is 

restricted. 


Pseudo-external identity 1 1 


If there is call/session with the client, location request is 
allowed without notification. 

If there is no call/session with the client, location request is 
with notification and privacy verification. Location request is 
restricted if no response. 


Pseudo-external identity 1 2 


If there is call/session with the client, location request is 
allowed without notification. 

If there is no call/session with the client, location request is 
allowed even if there is no response from UE. 


Pseudo-external identity 1 3 


If there is call/session with the client, location request is 
allowed without notification. 

If there is no call/session with the client, location request is 
allowed with notification. 


Pseudo-external identity 14 
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Annex D (normative): 

including Requestor identity to LCS client name 

In case the MSC/SGSN or the UE is pre Rel-5 then there is no possibiHty to send the Requestor identity to the UE in a 
new separate parameter. To obtain this backward compatibility the GMLC can add the Requestor identity to LCS cUent 
name. 

In order to offer best possible service for the end user the UE should be able to differentiate LCS client name and 
Requestor ID when they are included in to a same parameter. Also it is important that the LCS client name and the 
Requestor ID are separated with a consistent manner. Therefore there is a need to define a rule how the GMLC should 
separate LCS client name and Requestor identity. In the box below is described the practice how the LCS cUent name 
and Requestor identity should be separated. 



LCS clientName==RequestorIdentity 



LCS client name and Requestor identity are separated with two equal signs. 

NOTE: It is possible that the Requestor identity does not fit into the LCS client name field. In that case as many 
characters as possible from the beginning is added to the LCS client name field. 
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Annex E (Informative): 

Handling of pseudonyms in location services 

There is a requirement in place on anonymity for both the requestor and the target in the LCS Stage 1, TS22.071, and 
there are or will be regulatory requirements to support anonymity in location services in some countries. It is seen as a 
basic service requirement that the user should be able to request anonymity at will. 

There are various methods available for providing anonymity-support for LCS. One model has been described by the 
GSM Association in the LS in TD S2-021 104 to 3GPP. In short, GSMA's model introduces the following logical 
architecture. 



Terminal 



9. Service response, 

< 

1 . Service request 



2. Obtain 
pseudonym 




7. Service response 

< 



3. Service request, 



witin pseudonym 



8. Obtain MSISDN 



LCS client 



•it 



PI^Q 5. Obtain verinym 



GMLC/ 
PPR 



4. Location request 
with pseudonym 
6. Location response 



Figure E.I : GSMA logical model to support anonymity 

In this PUSH model the pseudonym of the target UE is always generated for certain LCS clients on behalf of the 
terminal's subscriber without a specific request. 

The PUSH model describes the case when the target UE requests its own location using e.g. SMS or WAP. SMS and 
WAP functions currently have problems in supporting anonymity, because the SMSAVAP gateways forward the 
originating MSISDN to the receiver. This weakness may be resolved in practise e.g. such that the SMS or WAP 
Gateway requests pseudonyms from a common device (PMD), as shown in Figure E. L In this process the gateway 
requests a pseudonym from PMD in signalling step 2 and in signalling step 3 the gateway uses the pseudonym in the 
service request that it sends to the LCS client. The gateway includes the requesting terminal's verinym, i.e. the 
MSISDN, in the service response it sends to the terminal in step 9. In this way the LCS client only knows the 
pseudonym of the terminal and not the verinym. This solution is not LCS specific, since the SMSAVAP gateway inserts 
pseudonyms in all SMSAVAP messages, which the gateway forwards to the receivers (LCS clients) defined by the 
operator in advance. 

The Liberty Alliance Project has standardized methods that can be used to ensure the anonymity of the target UE in 
location services using pseudonyms as shown by the example in Figure E.2 below. The specifications of the Liberty 
Alliance project are publicly available at http://www.projectliberty.org/. 
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Terminal 



10. Final Ser. Resp 
< 



1 . Service request 



Liberty 
enabled 
Proxy/ 
Gateway 



4. Obtain pseudonym 



9. Anonym Ser. Resp 
< 



2. Anonym Ser. Req 



3. Pseudonym Req 



5. Pseudonym Resf)^ 



n LCS 

client 



PPR/PMD 
(IPD) 



7. Obtain Verinym 
< ► 



6. Location request 
8. with pseudonym 

8. Location Response 



GMLC 



Figure E.2: Logical model to support anonymity 

In this PULL model the LCS cHent requests the pseudonym from the Gateway before accepting the service request from 
the terminaL The proxy/gateway is a so-called Liberty Enabled Client/Proxy, which also may support standard WAP 
proxy/gateway functions as described in the appropriate WAP Forum specifications. 

1 . The terminal (UE) sends a standard Wireless Transport Protocol (WTP) -request to the Proxy/Gateway. 

2. The proxy/gateway converts the service request into an HTTP -request with a dynamic IP address. This HTTP- 
request does not contain the MSISDN of the terminal, so it is totally anonymous to the LCS-client. 

3. The LCS-client needs to get an assertion, i.e. a pseudonym, before it can accept to provide location services to 
the terminal, so it sends a HTTP-response to the Proxy/Gateway, which includes a request for a pseudonym. 

4. The proxy/gateway maps the LCS client's HTTP -response to the HTTP -request it sent in step 2 and thus the 
proxy/gateway also knows to which terminal the LCS client's HTTP-response is related. The proxy/gateway 
intercepts and interprets the HTTP-response and finds the pseudonym request. It forwards the pseudonym 
request to PMD and attaches the terminal's MSISDN to allow the PMD to provide a pseudonym related to this 
MSISDN. In case PMD needs to contact the target UE user for some reason, e.g. to ask for consent to deliver the 
pseudonym to this specific LCS-client, this interaction is fully supported in the Liberty Enabled Client/Proxy 
specification. 

5. The proxy/gateway sends an HTTP-request containing the pseudonym to the LCS-client. 

6. The LCS-client sends a location service request to GMLC using the pseudonym of the target terminal. 

7. The PMD may include the MSISDN in the pseudonym by encrypting it in such a way that GMLC is able to 
determine the MSISDN itself and in such a case step 7 is not needed. In case GMLC cannot find out the verinym 
of the terminal itself, it requests from PMD the MSISDN that corresponds to the pseudonym it received from the 
LCS-client. 

8. GMLC provides location information to the LCS-client using the pseudonym of the target terminal. 

9. The LCS-client sends an HTTP-response to the proxy/gateway containing the requested location specific service 
content. 

10. The proxy/gateway maps the response to the outstanding request sent in step 1 and delivers the result to the 
correct terminal using MSISDN. 

Note that the mechanism described above is a generalized solution to the problem of transporting something from 
party 1 (PMD) to party 3 (GMLC) so that intermediate party 2 (LCS-client) cannot find out the real content transferred 
between party 1 and party 3 (verinym in this case). Also note that since the proxy/gateway does not push any 
pseudonym in step 2, it is not required to understand the destination application and what information it may need. 
Step 3 allows any application to request a pseudonym or any information it may need, thus making this a generalized 
solution, which may be used for many types of applications, not only LCS. 

It is to be noted that the Liberty release 1.1 specification has been carefully studied by the EU article 29 committee and 
found to be in accordance with the current EU privacy requirements. It is stressed, however, that it is the responsibihty 
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of someone implementing or deploying a system in accordance with the Liberty Alliance specifications to comply with 
EU directives and requirements on privacy. 

For roaming cases chapter 9.1.1 in this specification describes the cases where the pseudonym contains the address(es) 
of the target UE's Home-GMLC so that the Requesting-GMLC can forward the location request to H-GMLC, which 
may determine the corresponding verinym itself or request the verinym from its associated PMD. 
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Annex F (Informative): 

Mechanism for performing Change of Area Event Detection 

Note: the classification (i.e. normative or informative) of this Annex is FFS. 

As described in section 9.1.9 that there may be alternative mechanisms to transfer the deferred MT-LR with Area Event 
request to the UE. This annex illustrates one mechanism. In this mechanism a Short Message Service (SMS) is used to 
transfer, to the UE/(U)SIM, the Area event detection request via an (U)SIM Application Toolkit application. 



F.1 (U)SIM Application Toolkit (USAT) Based Solution 

In this (U)S AT based solution, the area event detection mechanism relies on the proactive control of the UE by the 
(U)SIM using the (U)SAT commands controlled by a specific Change of Area Deferred Location application. Figure 
F. I illustrates one possible method for downloading a change of area event application to the UE, but does not detail the 
operation of the application. The details of the application is outside the scope of this specification. Further information 
about the possible (U)SAT commands, can be found from TS 31.111. 

The following procedure (shown in Figure F. 1) replaces Figure 9.6d in clause 9.1.9. 



LCS Client 



R-GMLC 



1. LCS Service Request 



H-GMLC 



MSC/SGSN 



UE/(U)SIM 



2. Common Procedures for LCS 



5. LCS Service Response 
4 -M — 



9. LCS Service Response 



3. USAT Application Deliver} - Change of Area Event 
Invoke + Notification 



4. USAT Application Deliver} Acknowledge 



7. Change of Area Event Rep ort 



8. Privacy Check 



6. Event Occurs 



Figure F.I : (U)SAT Application Download and Change of Area Event Detection Procedure 

1) This step is the same as step 1 in clause 9.1.9. 

2) This step is similar to step 2 in clause 9.1.9, except the LCS Service Request does not reach the V-GMLC. Also 
the H-GMLC may request a translation of geographic shape to network identities from a GMLC in the network 
serving the target UE. 

3) Information about the event, the (U)S AT application, that shall trigger the sending of the Location Report shall 
be sent to the UE/(U)SIM. If privacy action (notification and/or verification) was requested as a result of the 
privacy check, the H-GMLC shall also include the required action to the UE/(U)SIM. If notification/verification 
is required, the request shall indicate the identity of the LCS client, the Requestor Identity (if available), and the 
reference number. The mechanism by which the trigger detection is performed via (U)SAT application may be 
operator dependent. However, the (U)SAT Application shall contain the following information: reference 
number, H-GMLC address, validity period of request, and the area definition (of the target area). 

4) If privacy verification was requested, the UE/(U)SIM indicates to its user whether the location request will be 
allowed or not allowed in the absence of a response and waits for the user to grant or deny permission. If privacy 
verification was requested and the user grants permission, the USAT Application shall be installed and the 
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UE/(U)SIM then returns an acknowledgement to the H-GMLC indicating permission is granted and (U)SAT 
application is successfully installed. If the UE user does not respond after a predetermined time period (and the 
request is not allowed in the absence of a response) or denies permission, the UE/(U)SIM shall infer a "no 
response" condition, the USAT Application is not installed, an appropriate error response is returned to the 
GMLC/LCS Client and the remaining steps are skipped. Otherwise the UE/(U)SIM notifies the UE user of the 
location request (if required by the privacy action) and shall install the (U)SAT application and acknowledge 
successful installation to the H-GMLC, including an indication of "no response" but request is allowed if 
necessary. If at any point the (U)SAT application fails to install, due to lack of support or otherwise, the 
UE/(U)SIM shall inform the H-GMLC using an appropriate error cause. 

5) The H-GMLC returns a LCS Service Response via R-GMLC to the LCS Client to notify whether the request was 
successfully accepted/installed or not, without a location estimate. When the R-GMLC returns the LCS Service 
Response to the LCS Client, the LDR reference number assigned by the R-GMLC shall be included. 

6) The UE/(U)SIM detects the desired change of area event. 

7) The UE/(U)SIM reports the change of area event. 

8) The H-GMLC may perform another privacy check as described in clause 9.1.1. 

9) The H-GMLC then returns a LCS Service Response to the LCS Client via the R-GMLC, if applicable, as in 
9.1.1. When the R-GMLC returns the LCS Service Response to the LCS Client, the LDR reference number that 
was sent to the LCS Client in step 5 shall be included. If the GMLC for some other reason decides to not wait 
any longer for the requested event to occur (e.g. timer expires), an LCS Service Response shall be returned with 
an appropriate error cause indicating termination of the deferred location request. 

H-GMLC may be the origination point of the SMS-DELIVER and the USAT Application messages. 
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Annex G (normative): 

Defined Service Types and numbering 

The defined Service Types and assigned numbers shall be as defined in TS 29.002 [18], clause 17.7.8. 
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Annex H (informative): 
Change history 



Change history 


Date 


TSG# 


TSG Doc. 


CR 


Rev 


Cat 


Subject/Comment 


Old 


New 


06/2010 


SP-48 


SP-1 00348 


0385 


2 


C 


Provide Service Type to E-SIVILC 


9.4.0 


10.0.0 


12/2010 


SP-50 


SP-1 00678 


0390 


- 


A 


Clarification on Cell ID notification to E-SIVILC 


10.0.0 


10.1.0 


01/2011 


- 






- 


- 


Update of LTE logo to LTE-Advanced logo 


10.1.0 


10.1.1 


03/201 1 


SP-51 


SP-1 10076 


0389 


2 


F 


Correction of Service Type assignments 


10.1.1 


10.2.0 


03/201 1 


SP-51 


SP-1 10062 


0392 


1 


A 


Clarification on Home eNodeB support 


10.1.1 


10.2.0 


2012-09 


- 


- 


- 


- 


- 


Update to Rel-1 1 version (MCC) 


10.2.0 


11.0.0 


2012-12 


SP-58 


SP-1 20711 


0395 


2 


A 


Continuation of LCS Session in EPS after SI 
Connection Release 


11.0.0 


11.1.0 


2012-12 


SP-58 


SP-1 20726 


0396 


3 


B 


Addition of UTDOA technology and SLm interface in LTE 


11.0.0 


11.1.0 
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